0x11 New UAC Value Expand / Collapse
Author
Message
Posted 8/1/2019 11:59:42 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/1/2019 11:50:32 AM
Posts: 1, Visits: 0
Hi Everyone,

I often see UAC value changed from 0x10 to 0x11 i have struggled to find a reference list for it, please can someone help me?

Thanks in advance
Post #8586
Posted 8/13/2019 2:55:54 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 4/23/2018 12:04:23 PM
Posts: 2, Visits: 2
0x10 is the lockout flag per: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738

I would assume that 0x11 means it changed from locked out to locked. I don't see any reference for 0x11 though. Perhaps some superadmin badass on this site can help out here?
Post #8587
Posted 1/15/2020 5:24:54 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/15/2020 5:13:12 PM
Posts: 1, Visits: 0
I often see UAC value changed from 0x10 to 0x11 i have struggled to find a reference list for it, please can someone help me?


Refer to a chart pertaining to the UserAccountControl field.

UserAccountControl is a bitwise field and it appears that two values were OR-ed together in this situation. The value of 0x10 indicates a LOCKOUT and the value of 0x01 indicates that a SCRIPT was associated. I suspect that the value for SCRIPT is a best practice that should be followed if you have automation that is performing AD maintenance.
Post #8614
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:57pm