Enable logging of Event ID 4740 on the Domain Controller

Under the “Default Domain Policy” on the GPMC.MSC enable the policy on the following location.

Computer Configuration > Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Account Management: Audit User Account Management → Define → Success and Failures.

Leave a Comment