In Windows Server 2008 R2 and Windows 7, security Event ID 4739 is not displayed correctly.
Case 1:
When you see the Security Event ID 4739 in event viewer, values of changed attributes, such as min. password age, are not shown correctly.
Case 2:
When you see the Security Event ID 4739 in event viewer, or if you run WMIC NTEVENT to query event, it shows an following error.
"Invalid XML Content"
- Event
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Event ID: 4739
Task Category: Authentication Policy Change
Level: Information
Keywords: Audit Success
Description: Domain Policy was changed
Change Type: Password Policy modified
Subject:
Security ID: SYSTEM
Account Name: <computer name>$
Account Domain: <domain name>
Logon ID: <number>
Domain:
Domain Name: <domain name>
Domain ID: <domain name>\
Changed Attributes:
Min. Password Age:
Max. Password Age:
Force Logoff:
Lockout Threashold:
Lockout Observation window:
Lockout Duration:
Password Properties:
Min. Password Length:
Password History Length:
Password History Length:
Machine Account Quota:
Mixed Domain Mode:
Domain Behavior version:
OEM Information
Additional Information:
Privileges:
Case 1:
When you see the Security Event ID 4739 in event viewer, values of changed attributes, such as min. password age, are not shown correctly.
Case 2:
When you see the Security Event ID 4739 in event viewer, or if you run WMIC NTEVENT to query event, it shows an following error.
"Invalid XML Content"
- Event
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Event ID: 4739
Task Category: Authentication Policy Change
Level: Information
Keywords: Audit Success
Description: Domain Policy was changed
Change Type: Password Policy modified
Subject:
Security ID: SYSTEM
Account Name: <computer name>$
Account Domain: <domain name>
Logon ID: <number>
Domain:
Domain Name: <domain name>
Domain ID: <domain name>\
Changed Attributes:
Min. Password Age:
Max. Password Age:
Force Logoff:
Lockout Threashold:
Lockout Observation window:
Lockout Duration:
Password Properties:
Min. Password Length:
Password History Length:
Password History Length:
Machine Account Quota:
Mixed Domain Mode:
Domain Behavior version:
OEM Information
Additional Information:
Privileges: