Event id 4739 not showing changed values Expand / Collapse
Posted 10/25/2013 9:53:00 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/9/2012 1:23:56 PM
Posts: 1, Visits: 0
When I change all values under Account Lockout Policy the event logged shows only the change made to Account Lockout Treshold and not to the two other settings!

I have could this article here: http://support.microsoft.com/kb/2536111/da but as you can see there is no fix for it.

Any idea's?

I'm running a test setup with a Windows 2008 R2 sp1 server and I make the changes in Domain policy and I have the same issue in a production environment

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 25-10-2013 15:48:44
Event ID: 4739
Task Category: Authentication Policy Change
Level: Information
Keywords: Audit Success
User: N/A
Computer: DC.Test.local
Domain Policy was changed.

Change Type: Lockout Policy modified

Security ID: SYSTEM
Account Name: DC$
Account Domain: TEST
Logon ID: 0x3e7

Domain Name: TEST
Domain ID: TEST\

Changed Attributes:
Min. Password Age: -
Max. Password Age: -
Force Logoff: -
Lockout Threshold: 5
Lockout Observation Window:
Lockout Duration:
Password Properties:
Min. Password Length:
Password History Length:
Machine Account Quota:
Mixed Domain Mode:
Domain Behavior Version:
OEM Information: -

Additional Information:
Privileges: -
Post #1269
Posted 11/18/2013 9:51:33 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
Unfortunately it looks like this is a known issue but a workaround is available. It requires the user to manually view the password policy using the Resultant Set of Policy (rsop.msc).
Post #1292
« Prev Topic | Next Topic »

Permissions Expand / Collapse

All times are GMT -5:00, Time now is 1:49am