Skip to content

Account-Management

Windows Event ID 4720: A user account was created

July 3, 2026

Windows Event ID 4722: A user account was enabled

July 3, 2026

Windows Event ID 4723: An attempt was made to change an account's password

July 3, 2026

Windows Event ID 4724: An attempt was made to reset an account's password

July 3, 2026

Windows Event ID 4725: A user account was disabled

July 3, 2026

Windows Event ID 4726: A user account was deleted

July 3, 2026

Windows Event ID 4727: A security-enabled global group was created

July 3, 2026

Windows Event ID 4728: A member was added to a security-enabled global group

July 3, 2026

Windows Event ID 4729: A member was removed from a security-enabled global group

July 3, 2026

Windows Event ID 4730: A security-enabled global group was deleted

July 3, 2026

Windows Event ID 4731: A security-enabled local group was created

July 3, 2026

Windows Event ID 4732: A member was added to a security-enabled local group

July 3, 2026

Windows Event ID 4733: A member was removed from a security-enabled local group

July 3, 2026

Windows Event ID 4734: A security-enabled local group was deleted

July 3, 2026

Windows Event ID 4735: A security-enabled local group was changed

July 3, 2026

Windows Event ID 4738: A user account was changed

July 3, 2026

Windows Event ID 4740: A user account was locked out

July 3, 2026

Windows Event ID 4741: A computer account was created

July 3, 2026

Windows Event ID 4742: A computer account was changed

July 3, 2026

Windows Event ID 4743: A computer account was deleted

July 3, 2026

Windows Event ID 4749: A security-disabled global group was created

July 3, 2026

Windows Event ID 4750: A security-disabled global group was changed

July 3, 2026

Windows Event ID 4751: A member was added to a security-disabled global group

July 3, 2026

Windows Event ID 4752: A member was removed from a security-disabled global group

July 3, 2026

Windows Event ID 4753: A security-disabled global group was deleted

July 3, 2026

Windows Event ID 4754: A security-enabled universal group was created

July 3, 2026

Windows Event ID 4756: A member was added to a security-enabled universal group

July 3, 2026

Windows Event ID 4764: A group's type was changed

July 3, 2026

Windows Event ID 4765: SID History was added to an account

July 3, 2026

Windows Event ID 4766: An attempt to add SID History to an account failed

July 3, 2026

Windows Event ID 4767: A user account was unlocked

July 3, 2026

Windows Event ID 4780: The ACL was set on accounts which are members of administrators groups (AdminSDHolder)

July 3, 2026

Windows Event ID 4781: The name of an account was changed

July 3, 2026

Windows Event ID 4782: The password hash of an account was accessed

July 3, 2026

Windows Event ID 4793: The Password Policy Checking API was called

July 3, 2026

Windows Event ID 4794: An attempt was made to set the DSRM administrator password

July 3, 2026

Windows Event ID 4798: A user's local group membership was enumerated

July 3, 2026

Windows Event ID 4799: A security-enabled local group membership was enumerated

July 3, 2026

Windows Event ID 4830: SID History was removed from an account

July 3, 2026

Windows Event ID 5376: Credential Manager credentials were backed up

July 3, 2026

Windows Event ID 5377: Credential Manager credentials were restored from a backup

July 3, 2026