|
|
|
Forum Newbie
Group: Forum Members
Last Login: 8/1/2019 11:50:32 AM
Posts: 1,
Visits: 0
|
|
Hi Everyone,
I often see UAC value changed from 0x10 to 0x11 i have struggled to find a reference list for it, please can someone help me?
Thanks in advance 
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 4/23/2018 12:04:23 PM
Posts: 2,
Visits: 2
|
|
0x10 is the lockout flag per: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
I would assume that 0x11 means it changed from locked out to locked. I don't see any reference for 0x11 though. Perhaps some superadmin badass on this site can help out here?
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 1/15/2020 5:13:12 PM
Posts: 1,
Visits: 0
|
|
I often see UAC value changed from 0x10 to 0x11 i have struggled to find a reference list for it, please can someone help me?
Refer to a chart pertaining to the UserAccountControl field.
UserAccountControl is a bitwise field and it appears that two values were OR-ed together in this situation. The value of 0x10 indicates a LOCKOUT and the value of 0x01 indicates that a SCRIPT was associated. I suspect that the value for SCRIPT is a best practice that should be followed if you have automation that is performing AD maintenance.
|
|
|
|