Event ID 4720 — Creating a user account

A new user account has been created.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Arrival of an employee
• Service account
• Unauthorized establishment

Verifications to be carried out

1. Identify the creator and the new account
2. Check the OR and groups
3. Compare with a change request

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.