> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-user-account-changes.md).

# Monitor User Account Changes

This lab changes a simple Active Directory user property and reviews the resulting security event.

## Objective

Generate and review Event ID `4738`, which records that a user account was changed.

## Make a Simple Change

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Locate `tempuser01`.
3. Open the account properties.
4. Change a harmless lab property such as the description.
5. Enter a value such as:

```
ZyberLab temporary test account
```

6. Apply the change.

## Find the Event

Open:

**Event Viewer > Windows Logs > Security**

Filter for:

```
4738
```

Open the newest event related to `tempuser01`.

## What to Review

Look for:

* the account that made the change
* the user account that was changed
* the event time
* account attributes shown in the event

Not every field will always show a useful value. Focus first on identifying the actor, the target account, and the timing.

## Verification

The lab is complete when you can connect the property change you made to Event ID `4738`.

You can remove the description afterward or leave it as a harmless lab note.

## Security Relevance

Changes to account properties can affect authentication, access, account behavior, or investigation context. Monitoring user changes helps identify unexpected administrative actions and provides evidence when reviewing identity-related incidents.