possible unwanted access to Windows PC and/or Emails (hotmail)

Hi,

Event ID: 4738: A user account was changed

Attributes show some of the properties that were set at the time the account was changed.

Event ID: 4797: A user account was changed

There is a lot of confusion about this event and no good explanation. unless you see this event on many different systems where caller workstation name is the same. Otherwise ignore.

http://superuser.com/questions/774728/event-id4797-an-attempt-was-made-to-query-the-existence-of-a-blank-password-fo

Please note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

Event ID: 4907: Auditing settings on object were changed

When you change the audit SACL of an object, such as a file or folder, Windows logs this event.  In the example below, Administrator configured a new audit policy on C:\Users\Administrator\testfolder.

To let event log record logon information (success and failure)

Audit logon events

https://technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

Regards,

D. Wu

June 17th, 2015 9:45pm

hi there.

I have some explained Event log entries, and some un-explained sign-ins on my emails.

Now i would like to know, how i would go about finding succesful and unsuccesful login attempts on my pc via event viewer?

Also, could someone explain EVENT ID: 4738; 4797; 4907?

There is one entry on my hotmail that i don't understand. I traced the IP address so i know some info about the source, however the Device and Browser is unknown. There are some others as well, i've also traced and done some research, so what i want to do is compare the entry's from Hotmail to my PC to see what was me and what wasn't, and so i can start an investigation and build some evidence.

Thanks

Free Windows Admin Tool Kit Click here and download it now
June 17th, 2015 10:56pm

For Hotmail ask here http://answers.microsoft.com/en-us/outlook_com/forum?tab=Threads

For event viewer ask here http://answers.microsoft.com/en-us/windows

Don't forget Google is your friend

June 17th, 2015 11:07pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics