Splunk Enterprise

Windows Event Code 4798 for Disabled Accounts

michaeler
Communicator

I admin an Enterprise instance. I was adding a report for use of service/default accounts when I noticed all of the built-in accounts (Visitor, DefaultAdmin, etc) generated the Event Code 4798, EventType=Audit Success, four times a day on the workstations. All of these accounts are disabled.

I'm assuming this is the system verifying that the built-in accounts are still disabled but I wanted to make sure. 

Can anyone confirm this or let me know what it actually means?

Labels (1)
0 Karma
1 Solution

hoaxm3
Path Finder

Yes, can confirm, groups are enumerated all day every day, so this traffic is relatively normal. If you are concerned: you can look to bring in AD information: https://splunkbase.splunk.com/app/1151/#/overview and then look for any logins (4624, 4768,4776,etc.) searching for the disabled users. 

View solution in original post

hoaxm3
Path Finder

Yes, can confirm, groups are enumerated all day every day, so this traffic is relatively normal. If you are concerned: you can look to bring in AD information: https://splunkbase.splunk.com/app/1151/#/overview and then look for any logins (4624, 4768,4776,etc.) searching for the disabled users. 

michaeler
Communicator

Thanks. They didn't generate any other Event Codes so I figured as such.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...