Forum

Ultimate Windows Security Forum » Security Log » 642 - User Account Changed » Changed Attributes in 642

Changed Attributes in 642 Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
tameka99_99
Posted 8/17/2011 11:31:28 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/26/2011 11:49:24 AM
Posts: 2, Visits: 0
When someone makes a change to the logon hours on an account it is not being logged in event 642 under the changed attributes - logon hours. Can you please tell me why this is not being logged and how I can fix this issue?

Thanks

Post #790
RandyFranklinSmith
Posted 11/14/2011 8:00:16 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Do you have Account Management enabled on your DCs?  I tested it and it showed up fine:

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 642
Date:  11/13/2011
Time:  2:39:40 PM
User:  ACME\administrator
Computer: DC1
Description:
User Account Changed:
  Target Account Name: lkjh
  Target Domain: ACME
  Target Account ID: ACME\lkjh
  Caller User Name: administrator
  Caller Domain: ACME
  Caller Logon ID: (0x0,0x5EAF9DE)
  Privileges: -
 Changed Attributes:
  Sam Account Name: -
  Display Name: -
  User Principal Name: -
  Home Directory: -
  Home Drive: -
  Script Path: -
  Profile Path: -
  User Workstations: -
  Password Last Set: -
  Account Expires: 12/14/2011 12:00:00 AM
  Primary Group ID: -
  AllowedToDelegateTo: -
  Old UAC Value: -
  New UAC Value: -
  User Account Control: -
  User Parameters: -
  Sid History: -
  Logon Hours: <value changed, but not displayed>


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Post #836
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:47am