Skip to main content
AD Academy
Back to all events
4738Security (DC)AccountsWARNLast updated:

User account changed

What it means

Account attributes changed: UAC flags, SPN, password-never-expires, encryption. A new SPN on a normal user is a red flag (Kerberoasting).

First steps

  1. 1Compare the old/new fields in the event.
  2. 2Watch for a new servicePrincipalName or pre-auth being disabled.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.