UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 646 - Computer Account Changed / Account changed on a DCPromo? / Latest PostsInstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comThu, 17 May 2012 09:13:05 GMT20RE: Account changed on a DCPromo?http://forum.ultimatewindowssecurity.com/Topic298-93-1.aspxInteresting question, Braino.</P><P>I don't know 646 logs a recognizable signature attributable to dcpromo or not but I get you could use Directory Service auditing and enable auditing of Write All Properties and get notification that way. either way testing is requriedThu, 14 Jan 2010 10:23:25 GMTRandyFranklinSmithAccount changed on a DCPromo?http://forum.ultimatewindowssecurity.com/Topic298-93-1.aspxI'm trying to use the security log to identify DCPromo's. Would this event show sufficient information? </P><P>What changes are made to a computer account when we promote it to a DC? </P><P>Could these changes be made to the account a computer that is not being promoted? </P><P>Thanks! :DTue, 12 Jan 2010 13:48:48 GMTBraino