Event-o-Pedia EventID 4739 - Domain Policy was changed.

	Event Details
	Operating System->Microsoft Windows->Built-in logs->Windows 2008 or higher->Security Log->Policy Change->Authentication Policy Change->EventID 4739 - Domain Policy was changed.

EventID 4739 - Domain Policy was changed.

Indicates that a domain policy was successfully changed by "caller user".

Find more information about this event on ultimatewindowssecurity.com.

Corresponding events on other OS versions:

Windows 2003

EventID 643 - Domain Policy Changed [Win 2003]

Windows 2000

EventID 643 - Domain Policy Changed [Win 2000]

Sample:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/28/2009 8:29:07 PM
Event ID:      4739
Task Category: Authentication Policy Change
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      dcc1.Logistics.corp
Description:   
Domain Policy was changed.
Change Type:    Password Policy modified
Subject:
  Security ID:    S-1-5-18
  Account Name:   DCC1$
  Account Domain:   LOGISTICS
  Logon ID:   0x3e7
Domain:
  Domain Name:    LOGISTICS
  Domain ID:    S-1-5-21-1135140816-2109348461-2107143693
Changed Attributes:
  Min. Password Age:  0
  Max. Password Age:  -
  Force Logoff:   -
  Lockout Threshold:  -
  Lockout Observation Window: -
  Lockout Duration: -
  Password Properties:  -
  Min. Password Length: -
  Password History Length:  -
  Machine Account Quota:  -
  Mixed Domain Mode:  -
  Domain Behavior Version:  -
  OEM Information:  -
Additional Information:
  Privileges:   -
===========================
Description template stored in adtschema.dll:
===========================
Domain Policy was changed.

Change Type:		%1 modified

Subject:
	Security ID:		%4
	Account Name:		%5
	Account Domain:		%6
	Logon ID:		%7

Domain:
	Domain Name:		%2
	Domain ID:		%3

Changed Attributes:
	Min. Password Age:	%9
	Max. Password Age:	%10
	Force Logoff:		%11
	Lockout Threshold:	%12
	Lockout Observation Window:	%13
	Lockout Duration:	%14
	Password Properties:	%15
	Min. Password Length:	%16
	Password History Length:	%17
	Machine Account Quota:	%18
	Mixed Domain Mode:	%19
	Domain Behavior Version:	%20
	OEM Information:	%21

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows Vista (2008) Windows 7 (2008 R2) Windows 8 (2012) Windows 8.1 (2012 R2) Windows 10 (2016)
Category	Policy Change
Source	Microsoft-Windows-Security-Auditing
TaskCategory	Authentication Policy Change
EventId	4739

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	Security
Type	Warning, Information, Error, Success, Failure, etc.	Type	Success
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	576
Description	The entire unparsed event message.	Description	Special privileges assigned to new logon.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	Security
Task Category	A name for a subclass of events within the same Event Source.	TaskCategory
Level	Warning, Information, Error, etc.	Level
Keywords	Audit Success, Audit Failure, Classic, Connection etc.	Keywords
Category	A name for an aggergative event class, corresponding to the similar ones present in Windows 2003 version.	Category	Account Logon
Object Name		-
Whom		-
Object Type		-
Class Name		-
Security ID		-
Account Name		-
Account Domain		-
Change Type	Name of the modified policy in format: "%{Policy Name} modified"	InsertionString1	%1 modified
Domain: Domain Name		InsertionString2	LOGISTICS
Domain: Domain ID		InsertionString3	S-1-5-21-1135140816-2109348461-2107143693
Changed Attributes: Min. Password Age		InsertionString9	0
Changed Attributes: Max. Password Age		InsertionString10	-
Changed Attributes: Force Logoff		InsertionString11	-
Changed Attributes: Lockout Threshold		InsertionString12	-
Changed Attributes: Lockout Observation Window		InsertionString13	-
Changed Attributes: Lockout Duration		InsertionString14	-
Changed Attributes: Password Properties		InsertionString15	-
Changed Attributes: Min. Password Length		InsertionString16	-
Changed Attributes: Password History Length		InsertionString17	-
Changed Attributes: Machine Account Quota		InsertionString18	-
Changed Attributes: Mixed Domain Mode		InsertionString19	-
Changed Attributes: Domain Behavior Version		InsertionString20	-
Changed Attributes: OEM Information		InsertionString21	-
Additional Information: Privileges		InsertionString8	-