Account Created and Changed Attributes Expand / Collapse
Author
Message
Posted 10/11/2012 1:05:56 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 10/11/2012 12:52:52 PM
Posts: 1, Visits: 1
When the Access Control staff create a new account and set a non-expiring password, the eventIDs (with the same date and time) that I've found on the DC are an account is created (4720), followed by an account password reset (4724), then an account was deleted (4726) and finally an account was changed (4738).  Because of this sequence of eventIDs, I get false positives for "An account was created and delete within an hour" alert.  Is this a standard set of events for Windows 2008 for their action?

Additionally, the change detail only includes the new account name and caller user name but no additional privilege changes.  Is there an account management setting that needs to be set?  Thanks.

Post #1119
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:51pm