These event IDs doesn?t give details information of what exactly are those changes.

If you like to look at the detail information of the changes, you will need to modify the existing report to look at other event ID. In specific, you need to look at event ID 624, 628 and 630. For your reference,

Event 624 is for user account created,

Event 628 is for user account password being set

Event 630 is for user account deleted

To modify the report to look at these event

1. select the ?Windows ? Computer Account changes? report, then click copy, then modify.

2. After that, leave everything as default until you see SQL query.

3. Change the last part of the query from

'Security_645_Security','Security_646_Security','Security_647_Security'

To

'Security_624_Security','Security_628_Security','Security_630_Security'

Then the rest can stay default. After that the report will show specifically for users account add, delete or password being set