Hi,
Event ID: 4738: A user account was changed
Attributes show some of the properties that were set at the time the account was changed.
Event ID: 4797: A user account was changed
There is a lot of confusion about this event and no good explanation. unless you see this event on many different systems where caller workstation name is the same. Otherwise ignore.
Please note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Event ID: 4907: Auditing settings on object were changed
When you change the audit SACL of an object, such as a file or folder, Windows logs this event. In the example below, Administrator configured a new audit policy on C:\Users\Administrator\testfolder.
To let event log record logon information (success and failure)
Audit logon events
https://technet.microsoft.com/en-us/library/cc787567%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396
Regards,
D. Wu