Windows Security Log Event ID 646
| Operating Systems |
Windows Server 2000
Windows 2003 and XP
|
|
Category | Account Management |
|
Type
|
Success
|
Corresponding events
in Windows
2008
and Vista |
4742
|
646: Computer Account Changed
On this page
"Target" computer account was changed by "Caller" user. For some types of changes the event will include a description of what was changed on the 2nd line of the description.
Free Security Log Resources by Randy
- Computer Account Changed: %1
- Target Account Name: %2 (A computer account is always followed by a "$".)
- Target Domain: %3
- Target Account ID: %4
- Caller User Name: %5
- Caller Domain: %6
- Caller Logon ID: %7
- Privileges: %8
- Changed Attributes: (The following events appear in Server 2003 only)
- Sam Account Name: %9
- Display Name: %10
- User Principal Name: %11
- Home Directory: %12
- Home Drive: %13
- Script Path: %14
- Profile Path: %15
- User Workstations: %16
- Password Last Set: %17
- Account Expires: %18
- Primary Group ID: %19
- AllowedToDelegateTo: %20
- Old UAC Value: %21
- New UAC Value: %22
- User Account Control: %23
- User Parameters: %24
- Sid History: %25
- Logon Hours: %26
- DNS Host Name: %27
- Service Principal Names: %28
Setup PowerShell Audit Log Forwarding in 4 Minutes
Computer Account Changed:
Account Enabled.
Target Account Name:COMP1$
Target Domain:ELMW2
Target Account ID:comp1
DEL:30f31309-cd32-4171-aad9-be7ddbfd04fe
Caller User Name:Administrator
Caller Domain:ELMW2
Caller Logon ID:(0x0,0x12D622)
Privileges:-
Windows Server 2003 adds these fields
Changed Attributes:
Sam Account Name:-
Display Name:-
User Principal Name:-
Home Directory:-
Home Drive:-
Script Path:-
Profile Path:-
User Workstations:-
Password Last Set:-
Account Expires:-
Primary Group ID:-
AllowedToDelegateTo:-
Old UAC Value:-
New UAC Value:-
User Account Control:-
User Parameters:-
Sid History:-
Logon Hours:-
DNS Host Name:-
Service Principal Names:-
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection