From 388373e9f377b3d9fd352e18b7dbdac6684e6223 Mon Sep 17 00:00:00 2001 From: TimShererWithAquent Date: Thu, 20 Aug 2020 14:41:16 -0700 Subject: [PATCH 1/4] Edit descriptions for SEO. --- windows/security/threat-protection/auditing/event-4706.md | 2 +- windows/security/threat-protection/auditing/event-4707.md | 2 +- windows/security/threat-protection/auditing/event-4713.md | 2 +- windows/security/threat-protection/auditing/event-4719.md | 2 +- windows/security/threat-protection/auditing/event-4720.md | 2 +- windows/security/threat-protection/auditing/event-4722.md | 2 +- windows/security/threat-protection/auditing/event-4725.md | 2 +- windows/security/threat-protection/auditing/event-4726.md | 2 +- windows/security/threat-protection/auditing/event-4738.md | 2 +- windows/security/threat-protection/auditing/event-4739.md | 2 +- windows/security/threat-protection/auditing/event-4740.md | 2 +- windows/security/threat-protection/auditing/event-4741.md | 2 +- windows/security/threat-protection/auditing/event-4742.md | 2 +- windows/security/threat-protection/auditing/event-4743.md | 2 +- windows/security/threat-protection/auditing/event-4764.md | 2 +- windows/security/threat-protection/auditing/event-4765.md | 2 +- windows/security/threat-protection/auditing/event-4767.md | 2 +- windows/security/threat-protection/auditing/event-4771.md | 2 +- windows/security/threat-protection/auditing/event-4774.md | 2 +- windows/security/threat-protection/auditing/event-4781.md | 2 +- 20 files changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md index c566c246bf..2a57c47db5 100644 --- a/windows/security/threat-protection/auditing/event-4706.md +++ b/windows/security/threat-protection/auditing/event-4706.md @@ -1,6 +1,6 @@ --- title: 4706(S) A new trust was created to a domain. (Windows 10) -description: Describes security event 4706(S) A new trust was created to a domain. +description: Describes security event 4706(S) A new trust was created to a domain. This event is generated when a new trust is created for a domain. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md index f998718c41..dc7e2f5419 100644 --- a/windows/security/threat-protection/auditing/event-4707.md +++ b/windows/security/threat-protection/auditing/event-4707.md @@ -1,6 +1,6 @@ --- title: 4707(S) A trust to a domain was removed. (Windows 10) -description: Describes security event 4707(S) A trust to a domain was removed. +description: Describes security event 4707(S) A trust to a domain was removed. This event is generated when a domain trust is removed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md index a4809630b7..69c6f2f153 100644 --- a/windows/security/threat-protection/auditing/event-4713.md +++ b/windows/security/threat-protection/auditing/event-4713.md @@ -1,6 +1,6 @@ --- title: 4713(S) Kerberos policy was changed. (Windows 10) -description: Describes security event 4713(S) Kerberos policy was changed. +description: Describes security event 4713(S) Kerberos policy was changed. This event is generated when Kerberos policy is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4719.md b/windows/security/threat-protection/auditing/event-4719.md index 4498dfe0fc..e634cf0bbf 100644 --- a/windows/security/threat-protection/auditing/event-4719.md +++ b/windows/security/threat-protection/auditing/event-4719.md @@ -1,6 +1,6 @@ --- title: 4719(S) System audit policy was changed. (Windows 10) -description: Describes security event 4719(S) System audit policy was changed. +description: Describes security event 4719(S) System audit policy was changed. This event is generated when the computer audit policy changes. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index fffcee9e09..d18fd86200 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -1,6 +1,6 @@ --- title: 4720(S) A user account was created. (Windows 10) -description: Describes security event 4720(S) A user account was created. +description: Describes security event 4720(S) A user account was created. This event is generated a user object is created. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md index 2029ba7eae..7d452aece6 100644 --- a/windows/security/threat-protection/auditing/event-4722.md +++ b/windows/security/threat-protection/auditing/event-4722.md @@ -1,6 +1,6 @@ --- title: 4722(S) A user account was enabled. (Windows 10) -description: Describes security event 4722(S) A user account was enabled. +description: Describes security event 4722(S) A user account was enabled. This event is generated every time user or computer object is enabled. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4725.md b/windows/security/threat-protection/auditing/event-4725.md index e1103b365e..367c2a2ace 100644 --- a/windows/security/threat-protection/auditing/event-4725.md +++ b/windows/security/threat-protection/auditing/event-4725.md @@ -1,6 +1,6 @@ --- title: 4725(S) A user account was disabled. (Windows 10) -description: Describes security event 4725(S) A user account was disabled. +description: Describes security event 4725(S) A user account was disabled. This event is generated every time user or computer object is disabled. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4726.md b/windows/security/threat-protection/auditing/event-4726.md index 5d48cc9ae6..51aedaf4f9 100644 --- a/windows/security/threat-protection/auditing/event-4726.md +++ b/windows/security/threat-protection/auditing/event-4726.md @@ -1,6 +1,6 @@ --- title: 4726(S) A user account was deleted. (Windows 10) -description: Describes security event 4726(S) A user account was deleted. +description: Describes security event 4726(S) A user account was deleted. This event is generated every time user object is deleted. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index e9761cde7b..d06136f653 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -1,6 +1,6 @@ --- title: 4738(S) A user account was changed. (Windows 10) -description: Describes security event 4738(S) A user account was changed. +description: Describes security event 4738(S) A user account was changed. This event is generated every time user object is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4739.md b/windows/security/threat-protection/auditing/event-4739.md index 9d9732a82c..59cf9ceaa8 100644 --- a/windows/security/threat-protection/auditing/event-4739.md +++ b/windows/security/threat-protection/auditing/event-4739.md @@ -1,6 +1,6 @@ --- title: 4739(S) Domain Policy was changed. (Windows 10) -description: Describes security event 4739(S) Domain Policy was changed. +description: Describes security event 4739(S) Domain Policy was changed. This event is generated when certain changes are made to local computer security policy. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4740.md b/windows/security/threat-protection/auditing/event-4740.md index 95cdfe7ee6..68838caedf 100644 --- a/windows/security/threat-protection/auditing/event-4740.md +++ b/windows/security/threat-protection/auditing/event-4740.md @@ -1,6 +1,6 @@ --- title: 4740(S) A user account was locked out. (Windows 10) -description: Describes security event 4740(S) A user account was locked out. +description: Describes security event 4740(S) A user account was locked out. This event is generated every time a user account is locked out. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md index ef907d69b0..cdd3b85851 100644 --- a/windows/security/threat-protection/auditing/event-4741.md +++ b/windows/security/threat-protection/auditing/event-4741.md @@ -1,6 +1,6 @@ --- title: 4741(S) A computer account was created. (Windows 10) -description: Describes security event 4741(S) A computer account was created. +description: Describes security event 4741(S) A computer account was created. This event is generated every time a computer object is created. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index b39135ee00..91c241a6db 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -1,6 +1,6 @@ --- title: 4742(S) A computer account was changed. (Windows 10) -description: Describes security event 4742(S) A computer account was changed. +description: Describes security event 4742(S) A computer account was changed. This event is generated every time a computer object is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4743.md b/windows/security/threat-protection/auditing/event-4743.md index 3fc25787d1..3cc90698fb 100644 --- a/windows/security/threat-protection/auditing/event-4743.md +++ b/windows/security/threat-protection/auditing/event-4743.md @@ -1,6 +1,6 @@ --- title: 4743(S) A computer account was deleted. (Windows 10) -description: Describes security event 4743(S) A computer account was deleted. +description: Describes security event 4743(S) A computer account was deleted. This event is generated every time a computer object is deleted. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4764.md b/windows/security/threat-protection/auditing/event-4764.md index 28f41dff94..31a0320260 100644 --- a/windows/security/threat-protection/auditing/event-4764.md +++ b/windows/security/threat-protection/auditing/event-4764.md @@ -1,6 +1,6 @@ --- title: 4764(S) A group's type was changed. (Windows 10) -description: Describes security event 4764(S) A group’s type was changed. +description: Describes security event 4764(S) A group’s type was changed. This event is generated every time group type is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4765.md b/windows/security/threat-protection/auditing/event-4765.md index c5310d9f72..3ea2c4e756 100644 --- a/windows/security/threat-protection/auditing/event-4765.md +++ b/windows/security/threat-protection/auditing/event-4765.md @@ -1,6 +1,6 @@ --- title: 4765(S) SID History was added to an account. (Windows 10) -description: Describes security event 4765(S) SID History was added to an account. +description: Describes security event 4765(S) SID History was added to an account. This event is generated when SID History is added to an account. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4767.md b/windows/security/threat-protection/auditing/event-4767.md index e5f3f71068..87baefbc54 100644 --- a/windows/security/threat-protection/auditing/event-4767.md +++ b/windows/security/threat-protection/auditing/event-4767.md @@ -1,6 +1,6 @@ --- title: 4767(S) A user account was unlocked. (Windows 10) -description: Describes security event 4767(S) A user account was unlocked. +description: Describes security event 4767(S) A user account was unlocked. This event is generated every time a user account is unlocked. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md index d8e637e093..af44f02711 100644 --- a/windows/security/threat-protection/auditing/event-4771.md +++ b/windows/security/threat-protection/auditing/event-4771.md @@ -1,6 +1,6 @@ --- title: 4771(F) Kerberos pre-authentication failed. (Windows 10) -description: Describes security event 4771(F) Kerberos pre-authentication failed. +description: Describes security event 4771(F) Kerberos pre-authentication failed. This event is generated when the Key Distribution Center fails to issue a Kerberos TGT. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4774.md b/windows/security/threat-protection/auditing/event-4774.md index df9ff558e3..21a33e20a2 100644 --- a/windows/security/threat-protection/auditing/event-4774.md +++ b/windows/security/threat-protection/auditing/event-4774.md @@ -1,6 +1,6 @@ --- title: 4774(S, F) An account was mapped for logon. (Windows 10) -description: Describes security event 4774(S, F) An account was mapped for logon. +description: Describes security event 4774(S, F) An account was mapped for logon. This event is generated when an account is mapped for logon. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4781.md b/windows/security/threat-protection/auditing/event-4781.md index 042f226a20..a48651e686 100644 --- a/windows/security/threat-protection/auditing/event-4781.md +++ b/windows/security/threat-protection/auditing/event-4781.md @@ -1,6 +1,6 @@ --- title: 4781(S) The name of an account was changed. (Windows 10) -description: Describes security event 4781(S) The name of an account was changed. +description: Describes security event 4781(S) The name of an account was changed. This event is generated every time a user or computer account name is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy From 4ea837d1a403deba57e60514499edb1f0dc9aa8d Mon Sep 17 00:00:00 2001 From: TimShererWithAquent Date: Fri, 21 Aug 2020 09:00:43 -0700 Subject: [PATCH 2/4] Additional fixes. --- windows/security/threat-protection/auditing/event-4722.md | 2 +- windows/security/threat-protection/auditing/event-4725.md | 2 +- windows/security/threat-protection/auditing/event-4726.md | 2 +- windows/security/threat-protection/auditing/event-4738.md | 2 +- windows/security/threat-protection/auditing/event-4739.md | 2 +- windows/security/threat-protection/auditing/event-4764.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md index 7d452aece6..97a958aba9 100644 --- a/windows/security/threat-protection/auditing/event-4722.md +++ b/windows/security/threat-protection/auditing/event-4722.md @@ -1,6 +1,6 @@ --- title: 4722(S) A user account was enabled. (Windows 10) -description: Describes security event 4722(S) A user account was enabled. This event is generated every time user or computer object is enabled. +description: Describes security event 4722(S) A user account was enabled. This event is generated when a user or computer object is enabled. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4725.md b/windows/security/threat-protection/auditing/event-4725.md index 367c2a2ace..c1bdc4c1f4 100644 --- a/windows/security/threat-protection/auditing/event-4725.md +++ b/windows/security/threat-protection/auditing/event-4725.md @@ -1,6 +1,6 @@ --- title: 4725(S) A user account was disabled. (Windows 10) -description: Describes security event 4725(S) A user account was disabled. This event is generated every time user or computer object is disabled. +description: Describes security event 4725(S) A user account was disabled. This event is generated when a user or computer object is disabled. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4726.md b/windows/security/threat-protection/auditing/event-4726.md index 51aedaf4f9..ae0997e85e 100644 --- a/windows/security/threat-protection/auditing/event-4726.md +++ b/windows/security/threat-protection/auditing/event-4726.md @@ -1,6 +1,6 @@ --- title: 4726(S) A user account was deleted. (Windows 10) -description: Describes security event 4726(S) A user account was deleted. This event is generated every time user object is deleted. +description: Describes security event 4726(S) A user account was deleted. This event is generated when a user object is deleted. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index d06136f653..7e70760f6b 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -1,6 +1,6 @@ --- title: 4738(S) A user account was changed. (Windows 10) -description: Describes security event 4738(S) A user account was changed. This event is generated every time user object is changed. +description: Describes security event 4738(S) A user account was changed. This event is generated when a user object is changed. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4739.md b/windows/security/threat-protection/auditing/event-4739.md index 59cf9ceaa8..644aa94187 100644 --- a/windows/security/threat-protection/auditing/event-4739.md +++ b/windows/security/threat-protection/auditing/event-4739.md @@ -1,6 +1,6 @@ --- title: 4739(S) Domain Policy was changed. (Windows 10) -description: Describes security event 4739(S) Domain Policy was changed. This event is generated when certain changes are made to local computer security policy. +description: Describes security event 4739(S) Domain Policy was changed. This event is generated when certain changes are made to the local computer security policy. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/event-4764.md b/windows/security/threat-protection/auditing/event-4764.md index 31a0320260..86df9d9645 100644 --- a/windows/security/threat-protection/auditing/event-4764.md +++ b/windows/security/threat-protection/auditing/event-4764.md @@ -1,6 +1,6 @@ --- title: 4764(S) A group's type was changed. (Windows 10) -description: Describes security event 4764(S) A group’s type was changed. This event is generated every time group type is changed. +description: "Describes security event 4764(S) A group's type was changed. This event is generated when the type of a group is changed." ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy From 5f31da59ce2da4dcf1b352b59d520750f3f6347d Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik Date: Tue, 25 Aug 2020 10:30:21 -0700 Subject: [PATCH 3/4] Update event-4738.md fix typo "apear" --- windows/security/threat-protection/auditing/event-4738.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index 7e70760f6b..3ad4e0bb93 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -32,7 +32,7 @@ This event generates on domain controllers, member servers, and workstations. For each change, a separate 4738 event will be generated. -You might see this event without any changes inside, that is, where all **Changed Attributes** apear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4738 event will generate, but all attributes will be “-“. +You might see this event without any changes inside, that is, where all **Changed Attributes** appear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4738 event will generate, but all attributes will be “-“. Some changes do not invoke a 4738 event. From 2993ef974ad7d7a63913a2569723a8e2d841e8e1 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik Date: Tue, 25 Aug 2020 10:31:08 -0700 Subject: [PATCH 4/4] Update event-4742.md fix typo "apear" --- windows/security/threat-protection/auditing/event-4742.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index 91c241a6db..018f2e1c21 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -36,7 +36,7 @@ For each change, a separate 4742 event will be generated. Some changes do not invoke a 4742 event, for example, changes made using Active Directory Users and Computers management console in **Managed By** tab in computer account properties. -You might see this event without any changes inside, that is, where all **Changed Attributes** apear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, this would happen if you change the **Description** of a group object using the Active Directory Users and Computers administrative console. Also, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4742 event will generate, but all attributes will be “-“. +You might see this event without any changes inside, that is, where all **Changed Attributes** appear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, this would happen if you change the **Description** of a group object using the Active Directory Users and Computers administrative console. Also, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4742 event will generate, but all attributes will be “-“. ***Important*:** If you manually change any user-related setting or attribute, for example if you set the SMARTCARD\_REQUIRED flag in **userAccountControl** for the computer account, then the **sAMAccountType** of the computer account will be changed to NORMAL\_USER\_ACCOUNT and you will get “[4738](event-4738.md): A user account was changed” instead of 4742 for this computer account. Essentially, the computer account will “become” a user account. For NORMAL\_USER\_ACCOUNT you will always get events from [Audit User Account Management](audit-user-account-management.md) subcategory. We strongly recommend that you avoid changing any user-related settings manually for computer objects.