UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 642 - User Account Changed

User enabled/disabled

dparker — Tue, 10 Jan 2012 15:04:35 GMT

We have a client that wants to monitor when a previously disabled user gets enabled again. There is an event for a user getting enabled, but apparently it is fired when a user is created as well.

If an existing disabled user gets enabled, will this show up in 642?

Changed Attributes in 642

tameka99_99 — Wed, 17 Aug 2011 11:31:28 GMT

When someone makes a change to the logon hours on an account it is not being logged in event 642 under the changed attributes - logon hours. Can you please tell me why this is not being logged and how I can fix this issue?

Thanks

User Account Control 'Don't Expire Password' - Enabled

tameka99_99 — Wed, 26 Jan 2011 11:53:43 GMT

Hi,

Event ID 642 captured the following in the changed attributes:

User Account Control: 'Don't Expire Password' - Enabled

Can you please explain what the user did here?

Thanks

ASPNET account changes (642)

aleisa — Mon, 02 Nov 2009 03:05:24 GMT

Hi,

I have a small question and appreciate if any one can explain:

In the EVENT log, 642 event is appeared for ASPNET account. and after investigation the only change I found is the last password change date. However the ASPNET is set with "user can't change password & password is never expired", I am not sure how such event will accrue in this scenario.

Thanks in advance

Regards,

Aleisa.

Finding the computer used to change domain user password

alfa21 — Mon, 14 Sep 2009 14:14:34 GMT

Hi,

I'm trying to figure out when a user change password, what computer the password change request came from.

I can't see this information neither on Domain Controller, not in the computer.

Thank you for any help

Account Changed

dukeminus — Tue, 07 Jul 2009 08:42:16 GMT

Is there a way to find out the following:

- What changed

- Who made the change