4738 Security log · Account Management medium severity medium volume

Windows Event ID 4738 — A user account was changed

User account attributes modified. Includes: UserAccountControl flags, PasswordExpiry, AccountExpires, SamAccountName, UserPrincipalName, ServicePrincipalNames.

Why event 4738 matters

Key attacks: SamAccountName spoofing (noPac/CVE-2021-42278), adding SPNs to user accounts for Kerberoasting, setting PasswordNeverExpires, disabling lockout. Attacker with write access to AD objects can silently modify these flags.

How to detect it

Alert: UserAccountControl change that sets DONT_REQUIRE_PREAUTH (flag 4194304) — enables AS-REP roasting. Alert: SamAccountName change on computer accounts (noPac). Alert: SPN added to user account (Kerberoasting setup). Alert: PasswordNeverExpires set on non-service accounts.

Log source
Security
Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Persistence Account Manipulation (T1098)
Credential Access Kerberoasting (T1558.003)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 4738   // A user account was changed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4738
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A user account was changed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 4738 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Account Management events

4720 A user account was created 4722 A user account was enabled 4723 An attempt was made to change an account's password 4724 An attempt was made to reset an account's password 4725 A user account was disabled 4726 A user account was deleted 4728 A member was added to a security-enabled global group 4729 A member was removed from a security-enabled global group 4730 A security-enabled global group was deleted 4731 A security-enabled local group was created 4732 A member was added to a security-enabled local group 4733 A member was removed from a security-enabled local group

Frequently asked questions

What is Windows Event ID 4738?

A user account was changed. User account attributes modified. Includes: UserAccountControl flags, PasswordExpiry, AccountExpires, SamAccountName, UserPrincipalName, ServicePrincipalNames.

Which log records event 4738?

Event 4738 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Account Management' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4738?

Event 4738 is associated with: Account Manipulation (T1098), Kerberoasting (T1558.003).

How do you detect activity around event 4738?

Alert: UserAccountControl change that sets DONT_REQUIRE_PREAUTH (flag 4194304) — enables AS-REP roasting. Alert: SamAccountName change on computer accounts (noPac). Alert: SPN added to user account (Kerberoasting setup). Alert: PasswordNeverExpires set on non-service accounts.