Event ID 4720: A user account was created
Written when a new user account is created, locally or in Active Directory (on domain controllers).
- Log
- Security
- Category
- Account management
Why it matters
- Attackers create accounts to keep access. Accounts created outside your normal joiner process, or out of hours, deserve a look.
- A new account quickly added to an admin group (4728, 4732, 4756) is a strong signal.
What to check
Check who created it (Subject), the new account's name and attributes, and whether a group membership change follows.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1136.001 Create Account: Local Account
- T1136.002 Create Account: Domain Account