Use Case sAMAccountName changes in domain controller

[shanaz]

Hi,

want to create a search to find anyone who does changes to the sAMAccountName 

So sAMAccountName could be sAMAccountName=cdf or sAMAccountName=abc

sAMAccountName=abc  if anyone changes this to sAMAccountName=abc1 triggers an alert. 

[richgalloway]

Windows event 4738 should tell you if the account name changed.  Look for SAM_Account_Name under Changed_Attributes.