Event ID 4741: A computer account was created
Written on domain controllers when a computer is joined to the domain or a computer account is created.
- Log
- Security
- Category
- Account management
Why it matters
- By default, ordinary users can create up to 10 computer accounts, which some Active Directory attacks rely on.
What to check
Check who created it and whether it matches a real device being joined.
How to turn it on
Advanced Audit Policy: Account Management > Audit Computer Account Management.
MITRE ATT&CK
- T1136.002 Create Account: Domain Account