SOC Event Lookup
Event ID 4738AccountMgmtP1

Windows Event ID 4738: A user account was changed

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4738 records a change to a user account and provides visibility into security-relevant attribute modification.

Technical Metadata

Technical metadata for Event ID 4738
Event ID4738
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1098 Account Manipulation
Key fields to watchSubject, Target Account, Changed Attributes

Trigger Scenarios

A domain controller logs the event when account properties such as UAC flags, delegation settings, password attributes, or profile fields are changed.

Key Fields

Subject

The account that performed the modification.

Target Account

The modified account. Compare old and new values with the expected identity state.

Changed Attributes

Fields such as User Account Control, AllowedToDelegateTo, and AccountExpires reveal the security impact of the change.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4738
SecurityEvent
| where EventID == 4738
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4738
index=wineventlog source="WinEventLog:Security" EventCode=4738
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4738
dataset = microsoft_windows_raw
| filter edr_event_id = 4738
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4738
title: Windows Security Event ID 4738
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4738
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
UserAccountControl0x400000DONT_REQ_PREAUTH: Kerberos preauthentication is not required for the account.A newly enabled value can expose the account to AS-REP roasting and should match an approved legacy requirement. Source
UserAccountControl0x80000TRUSTED_FOR_DELEGATION: the account is trusted for Kerberos delegation.Unexpected delegation broadens where the account can impersonate authenticated users and is a high-impact account change. Source

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

T1098 Account Manipulation is indicated when UserAccountControl adds DONT_REQ_PREAUTH (0x400000) or TRUSTED_FOR_DELEGATION (0x80000), or AllowedToDelegateTo gains an SPN such as cifs/server. The first value permits Kerberos requests without preauthentication and the second expands delegation; correlate the SubjectLogonId with the initiating session in a window=60 minutes and compare the prior directory state.

Common False Positives

  • HR systems and directory synchronization update account attributes routinely.
  • Administrators may modify account properties during access provisioning.

Related Events

Sample Log

Sanitized event sample
Subject: CORP\admin.ops
Target Account: CORP\jsmith
User Account Control: Account enabled
AllowedToDelegateTo: cifs/file01.corp.example

Frequently Asked Questions

What does Windows Event ID 4738 mean?

Event ID 4738 records that a Windows user account changed and includes the actor, target account, and changed account attributes.

Which 4738 account changes are security-sensitive?

Review delegation settings, password and expiration controls, user principal name, script path, allowed workstation list, and UserAccountControl changes against an approved identity-management workflow.

Does Event ID 4738 identify exactly which attribute changed?

It provides current values for documented fields, but unchanged fields can be represented by a hyphen and interpretation can vary by event version; compare with directory change auditing and the prior account state.

Sources