Re: Account management audit

From: Mykhaylo Khodorev (ralfeus_at_chicagocentre.com.ua)
Date: 09/21/04 

Date: Tue, 21 Sep 2004 09:25:06 +0300

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 642
Date: 20.09.2004
Time: 10:49:01
User: ICB\rralfeus
Computer: DC1
Description:
User Account Changed:
  -
  Target Account Name: ralfeus
  Target Domain: ICB
  Target Account ID: ICB\ralfeus
  Caller User Name: rralfeus
  Caller Domain: ICB
  Caller Logon ID: (0x0,0x1D369373)
  Privileges: -

This event occured when I've changed expiration date of account icb\ralfeus.
Here is nothing told about this. Or I missed anything?
Thanks.
Mykhaylo

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

"Cary Shultz [A.D. MVP]" <cwshultz@mvps.org> wrote in message
news:uO%231m0xnEHA.3464@tk2msftngp13.phx.gbl...
> Good morning,
>
> I am not sure that I am following you. When I use Account Management
> Auditing IIRC then the first line in the EventID is what was changed
> followed by a bunch of information ( target and caller, etc. ).
>
> So, if I change the password on a user account object via the ADUC MMC and
> then go look in my Security log I should see a 642 ( user account
> changed )
> followed by a 628 ( user account password set ). The 'bunch of
> information'
> is general something similar to the following:
>
> Target Account Name
> Target Domain
> Target Account ID
> Caller User Name
> Caller Domain
> Caller Logon ID
>
> With the 'Target Account Name' being the user account object for whom I
> just
> changed the password and the 'Caller User Name' being me, aka
> Administrator
> ( or Support or whatever account I was using to do this....assuming,
> naturally, that it has the correct permissions ).
>
> Are you seeing something similar or something completely different? Also,
> I
> am going from memory so please excuse me if this is not exactly as it
> really
> appears.
>
> HTH,
>
> Cary
>
> "Mykhaylo Khodorev" <ralfeus@chicagocentre.com.ua> wrote in message
> news:cim32f$25ge$1@news.dg.net.ua...
>> Hi, all
>> When I change an account expiration date, in event log I see just
>> information that account was changed. But I can't see what exactly was
>> changed. Is it right?
>> Thanks.
>> Mykhaylo
>>
>>
>
>

Relevant Pages

  • Re: Account management audit
    ... if you add or remove a user account object from ... > Target Account ID: ICB\ralfeus ... > Caller Domain: ICB ...
    (microsoft.public.win2000.active_directory)
  • Re: Log Information
    ... Description: User Account Deleted: ... Target Account ID: %3 Caller User Name: %4 ... Audit account managementhttp://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/g ... ...
    (microsoft.public.exchange.admin)
  • Re: Unexplained User Account Deletion
    ... event log is at the heart of the problem in light of the fact that the ... GUID' statement literally, however I am referring to the DEL: ... Category: Account Mgmt ... Target Account Name: User1 ...
    (microsoft.public.windows.server.active_directory)
  • Re: Unexplained User Account Deletion
    ... Joe Richards Microsoft MVP Windows Server Directory Services ... GUID' statement literally, however I am referring to the DEL: ... Category: Account Mgmt ... Target Account Name: User1 ...
    (microsoft.public.windows.server.active_directory)
  • domain accounts are being locked out repeatedly
    ... A few hours ago I changed the passwords for one of the account back to its old password. ... Target Account ID: IR\username ... Caller Machine Name: IR-EXCH-SRV ...
    (microsoft.public.win2000.security)