Skip to main content

Account

5actions

9reasons

1sources

Livestatus

A user or computer account in the directory or on the local host.

Identified by: sparklogs.config_change.target, which carries a name, or a fixed name where a host carries only one.

Action	Reported by	What that reason says
`created`	`account_created` on Windows Security event log	A user or computer account was created in the directory or local SAM.
`deleted`	`account_deleted` on Windows Security event log	A user or computer account was deleted from the directory or local SAM.
`disabled`	`account_disabled` on Windows Security event log	A user or computer account was disabled and can no longer authenticate.
`enabled`	`account_enabled` on Windows Security event log	A user or computer account that was disabled has been enabled and can authenticate again.
`updated`	`account_changed` on Windows Security event log	An attribute on an existing user or computer account was modified.
`updated`	`account_password_reset` on Windows Security event log	One principal reset the password of another principal, and the reset completed.
`updated`	`dsrm_password_changed` on Windows Security event log	The Directory Services Restore Mode (DSRM) password was set on a domain controller. That password unlocks offline DC recovery.
`updated`	`principal_renamed` on Windows Security event log	A security principal was renamed. The identifier is unchanged, so events before and after this row describe the same principal under two different names.
`updated`	`sid_history_added` on Windows Security event log	SID History was added to an account. Rare outside migrations; often a privilege-inheritance or persistence tell.