UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 646 - Computer Account Changed

what constitutes a change

jbenjamin5 — Wed, 25 Apr 2012 15:32:43 GMT

I am using a siem to track computers being added and deleted from my domain. I want to also track changes. The event 646 doesn't have the actual change in it. Is there a way to track what has been changed? What constitutes a change? Thanx!

Account changed on a DCPromo?

Braino — Tue, 12 Jan 2010 13:48:48 GMT

I'm trying to use the security log to identify DCPromo's. Would this event show sufficient information?

What changes are made to a computer account when we promote it to a DC?

Could these changes be made to the account a computer that is not being promoted?

Thanks! :D