Windows Security Log Event ID 4782

4782: The password hash an account was accessed

On this page

• Description of this event
• Field level details
• Examples

This typically happens when something like the Active Directory Migration Tool (ADMT) is moving password data.

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4782

Subject:

   Security ID:  %3
   Account Name:  %4
   Account Domain:  %5
   Logon ID:  %6

Target Account:

   Account Name:  %1
   Account Domain:  %2

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

Mini-Seminars Covering Event ID 4782 AD Password Security Deep Dive: NTLM, Kerberos, Hashing and Beyond Assessing the Security of Your Active Directory: User Accounts

 

Upcoming Webinars Protecting Data On USB Drives: Hardware Options, Windows BitLocker and Mac APFS and Beyond The Changing Landscape of Authentication and Logon Tracking in Hybrid Environments of Entra and AD Understanding REST APIs and Their Security Issues: Secrets, Input Validation, Output Filtering, Call Limits, Automation, Authorization

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy