Windows Security Log Event ID 4793

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
Category
 • Subcategory		Account Management
 • Other Account Management Events
Type Success
Corresponding events
in Windows 2003
and before		  

4793: The Password Policy Checking API was called

On this page

Microsoft says this is "typical behavior" and can be ignored.  I concur.  You may frequently see it on SQL Servers.

Free Security Log Resources by Randy

Description Fields in 4793

Subject:

  •  Security ID:  %1
  •  Account Name:  %2
  •  Account Domain:  %3
  •  Logon ID:  %4

Additional Information:

  •  Caller Workstation: %5
  •  Provided Account Name (unauthenticated): %6
  •  Status Code: %7

Supercharger Free Edition


Centrally manage WEC subscriptions.

Free.

 

Examples of 4793

The Password Policy Checking API was called.

Subject:

   Security ID:  SYSTEM
   Account Name:  WIN-R9H529RIO4Y$
   Account Domain:  WORKGROUP
   Logon ID:  0x3e7

Additional Information:

   Caller Workstation: WIN-R9H529RIO4Y
   Provided Account Name (unauthenticated): -
   Status Code: 0x0

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



Mini-Seminars Covering Event ID 4793
Stay up-to-date on the Latest in Cybersecurity
Sign up for the Ultimate IT Security newsletter to hear about the latest webinars, patches, CVEs, attacks, and more.
Work Email:

 

Upcoming Webinars
    Additional Resources

      Go To Event ID:

      Security Log
      Quick Reference
      Chart
      Download now!