Nothing matches that yet. Tell us what you were looking for and it goes on the list.
Windows Security Log · Event 4738
An attribute on an account was modified. It fires constantly and most of it is meaningless, but a handful of the flags it records are among the clearest attack indicators in Active Directory — particularly the one that disables Kerberos pre-authentication.
Also written as Event ID 4738A user account was changed4738 account changed
A setting on an account was changed. Windows logs this for almost any account edit, so on its own it rarely means anything.
Only the User Account Control field is worth alerting on. The message shows values that changed and dashes for those that did not, so diffing is done for you. DONT_REQ_PREAUTH being set is close to a standalone alert — it makes the account AS-REP roastable and there is essentially no legitimate reason to enable it.
Sanitised. Addresses come from the RFC 5737 documentation ranges.
A user account was changed.
Subject:
Security ID: CORP\jbrooks-adm
Account Name: jbrooks-adm
Account Domain: CORP
Logon ID: 0x3E9A11
Target Account:
Security ID: CORP\svc-legacy
Account Name: svc-legacy
Account Domain: CORP
Changed Attributes:
SAM Account Name: svc-legacy
Display Name: -
User Principal Name: -
Home Directory: -
Script Path: -
Password Last Set: -
Account Expires: -
User Account Control:
'Don't Require Preauth' - EnabledEverything else in the log line is context.
DONT_REQ_PREAUTHKerberos pre-authentication disabled. Makes the account AS-REP roastable — an attacker can request material to crack offline without ever authenticating. Almost never legitimate. DONT_EXPIRE_PASSWDThe password will never expire. Common for service accounts, and a way to make a compromised credential last indefinitely. PASSWD_NOTREQDThe account may have no password at all. Rarely legitimate. TRUSTED_FOR_DELEGATIONUnconstrained delegation. Lets the host impersonate any user that authenticates to it — a serious escalation route. ENCRYPTED_TEXT_PWD_ALLOWEDReversible encryption for the password, which effectively stores it in a recoverable form. NORMAL_ACCOUNTOrdinary account type. Appears in most of these events and means nothing on its own. Most of the time it is one of these.
What gives it awayDONT_REQ_PREAUTH appearing in the User Account Control field. The attacker can then request encrypted material for the account and crack it offline without ever needing to authenticate.
ATT&CK T1558.004What gives it awayDONT_EXPIRE_PASSWD set on an account that previously rotated, so a stolen password keeps working indefinitely.
ATT&CK T1098What gives it awayTRUSTED_FOR_DELEGATION set, which allows impersonation of any account that authenticates to that host.
ATT&CK T1134.001What gives it awayENCRYPTED_TEXT_PWD_ALLOWED set, which is effectively reversible storage of the credential.
ATT&CK T1098What gives it awayPASSWD_NOTREQD set, allowing the account to have no password at all.
ATT&CK T1098SecurityEvent | where EventID == 4738 | where RenderedDescription has_any ('DONT_REQ_PREAUTH','PASSWD_NOTREQD','TRUSTED_FOR_DELEGATION','ENCRYPTED_TEXT_PWD_ALLOWED') | project TimeGenerated, Computer, Target = TargetUserName, ChangedBy = SubjectUserName, RenderedDescriptionSecurityEvent | where EventID == 4738 and RenderedDescription contains 'DONT_REQ_PREAUTH' | project TimeGenerated, Computer, TargetUserName, SubjectUserNameGet-ADUser -Filter { DoesNotRequirePreAuth -eq $true } -Properties DoesNotRequirePreAuth | Select-Object SamAccountName, DistinguishedNameindex=wineventlog EventCode=4738 ("DONT_REQ_PREAUTH" OR "PASSWD_NOTREQD" OR "TRUSTED_FOR_DELEGATION") | table _time Account_Name Security_ID MessageBecause almost any modification to an account writes one — password changes, enabling and disabling, attribute updates from HR synchronisation, group changes. In a domain with identity management tooling it is one of the highest-volume account events. Filter to the User Account Control field and the volume collapses to something readable.
It disables Kerberos pre-authentication for that account. With it off, anyone can ask a domain controller for encrypted material for the account and try to crack the password offline, without ever authenticating or triggering a failed logon. It is called AS-REP roasting, and there is almost no legitimate reason to enable the flag — treat it as a finding.
A dash means that attribute did not change. Windows lists the full set of attributes every time and fills in only the ones that were modified, so the dashes are how you tell what the change actually was.
It is worth reviewing rather than alerting. It is genuinely common on service accounts where rotation would break an application. What matters is it appearing on a normal user account, or being newly set on an account that previously rotated — that turns a stolen password into permanent access.
Last reviewed 28 August 2026