Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Monitor Pack (MS6) - Windows - Monitor User Account Management

Created: 22 May 2009
Antonp's picture
+1 1 Vote
Login to vote

The "Account Management" Audit policy is very detailed in Windows 2000 and in later service packs of Windows NT 4.0. By enabling success and failure auditing for this event category, you enable the following events:

  • 624 User Account Created
  • 625 User Account Type Change
  • 626 User Account Enabled
  • 627 Change Password Attempt
  • 628 User Account password set
  • 629 User Account Disabled
  • 630 User Account Deleted