topic Re: Windows Event Code 4798 for Disabled Accounts in Splunk Enterprise

Windows Event Code 4798 for Disabled Accounts

michaeler — Tue, 23 Mar 2021 16:46:15 GMT

I admin an Enterprise instance. I was adding a report for use of service/default accounts when I noticed all of the built-in accounts (Visitor, DefaultAdmin, etc) generated the Event Code 4798, EventType=Audit Success, four times a day on the workstations. All of these accounts are disabled.

I'm assuming this is the system verifying that the built-in accounts are still disabled but I wanted to make sure.

Can anyone confirm this or let me know what it actually means?

Re: Windows Event Code 4798 for Disabled Accounts

hoaxm3 — Tue, 23 Mar 2021 17:18:47 GMT

Yes, can confirm, groups are enumerated all day every day, so this traffic is relatively normal. If you are concerned: you can look to bring in AD information: https://splunkbase.splunk.com/app/1151/#/overview and then look for any logins (4624, 4768,4776,etc.) searching for the disabled users.

Re: Windows Event Code 4798 for Disabled Accounts

michaeler — Tue, 23 Mar 2021 18:03:08 GMT

Thanks. They didn't generate any other Event Codes so I figured as such.