24013: Account unlocked
Event 24013 occurs when a SQL server login account gets unlocked. This event occurs when a privileged user (administrator) unlocks a user's locked account. This event is important in the security context because it helps keep track of when a user's account was unlocked after being locked out. It is generated by the LOGIN_CHANGE_PASSWORD_GROUP action group. Administrators can derive important information from this event including the:
- Date and time at which the event occurred.
- Session identifier of the event.
- Privileged user who performed the action.
- ID, name, and type of the target object (in this case, the SQL server login).