Security Compliance
SEM Event computer account changed after hours
Using the default alerts you get some alerts on out of business hours such as: computer account "somename-dm\johnjjj$" changed: "-" at 2016-03-09 01:14:39.0 But what has changed? The business isn't open at 1am and no one should have access.
First published date
Last published date
Overview
This article provides information about the Security Event Manager (formerly Log & Event Manager) Event computer account changing after hours.
Using the default alerts, you get some alerts on out of business hours such as:
computer account "somename-dm\johnjjj$" changed: "-" at 2016-03-09 01:14:39.0
What changed in this example?
The business isn't open at 1AM and no one should have access.
Product section
Resolution
SEM monitors and acts on Events. It is likely that you are receiving a Windows eventid=646 or 4742.
In SEM, this is represented as the ProviderSID.
Check the link below for more details:
https://www.ultimatewindowssecurity....px?eventid=646 (© 2018 Monterey Technology Group, Inc., available at https://www.ultimatewindowssecurity.com, obtained on December 6, 2018)
https://www.ultimatewindowssecurity....x?eventID=4742 (© 2018 Monterey Technology Group, Inc., available at https://www.ultimatewindowssecurity.com, obtained on December 6, 2018)
Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.