azureblog.co.uk
← cd ~/events
// events/4765 · Accounts

Event ID 4765SID History was added to an account

SID History was added to an account, which normally only happens during a domain migration.

LogSecurity
SourceMicrosoft-Windows-Security-Auditing
AreaAccounts

What to check

Microsoft gives no specific recommendation; outside a planned domain migration, find out who added it and why.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4765 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4765
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Accounts events

Search all 123 event IDs →

Sources