← cd ~/events
// events/4720 · Accounts
Event ID 4720A user account was created
A new user object was created, on a domain controller for domain accounts or locally on a member server or workstation.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Accounts |
What to check
Review who created it (Subject) and check for oddities such as a blank SAM account name, a primary group other than 513 or a password that was never set.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4720 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4720
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Accounts events
- Event ID 4722: A user account was enabled
- Event ID 4723: An attempt was made to change an account's password
- Event ID 4724: An attempt was made to reset an account's password
- Event ID 4725: A user account was disabled
- Event ID 4726: A user account was deleted
- Event ID 4738: A user account was changed
- Event ID 4740: A user account was locked out
- Event ID 4767: A user account was unlocked