Event ID 4738: user account changed
What Event ID 4738 (user account changed) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4738 is written whenever a user account is changed. Most of the time it is the helpdesk resetting a password or updating a phone number. But a handful of attribute changes are classic attacker moves, and 4738 lists exactly which attributes changed, so you can filter for them instead of reading every event.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject > Account Name | Who made the change. |
| Target Account | The account that was changed. |
| Changed Attributes | Only the attributes that changed have a value; the rest show -. |
| User Account Control | Flags switched on or off, such as 'Don't Require Preauth' - Enabled or 'Password Not Required' - Enabled. |
| SID History / Allowed To Delegate To | Rarely changed in normal operations, and powerful when they are. |
What is normal
Password resets (4738 alongside 4724), name and department updates from HR sync tools, and accounts being enabled or disabled by the helpdesk.
When Event ID 4738 is suspicious
Don't Require Preauthenabled: the account can now be AS-REP roasted (MITRE T1558.004).Password Not RequiredorDon't Expire Passwordset on an admin or service account.- SID History added: the account may quietly gain the rights of another account, even a Domain Admin.
- A delegation setting (Allowed To Delegate To) added to a user account.
- Changes made by an account that is not part of IT, or outside working hours.
Common false positive: Identity sync tools and HR integrations can produce thousands of 4738 events a day. Filter on the User Account Control and SID History fields rather than alerting on every change.
Find Event ID 4738 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4738; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4738
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4720: User account created
- Event ID 4724: Password reset by another account
- Event ID 4728: Member added to global security group
- Event ID 4768: Kerberos TGT requested
FAQ
What is AS-REP roasting?
If an account does not require Kerberos pre-authentication, anyone can ask the domain controller for data encrypted with that account's password and crack it offline. Look for 4768 events with pre-authentication type 0 for that account.
Does a password reset create Event ID 4738?
Usually yes, together with 4724 (password reset by someone else) or 4723 (user changed their own password).
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.