| Event Id | 4720 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | A user account was created. Subject: Security ID:<Security ID> Account Name:<Account Name> Account Domain:<Domain name> Logon ID:<Logon ID> New Account: Security ID:<Security ID> Account Name:<Account Name> Account Domain:<Domain name> Attributes: SAM Account Name:<SAM Account Name> Display Name:<Display Name> User Principal Name:<User Principal Name> Home Directory:<Home Directory> Home Drive:<Home Drive> Script Path: <Script Path> Profile Path:<Profile Path> User Workstations:<User Workstations> Password Last Set:<Password Last Set> Account Expires:<Account Expires> Primary Group ID:<Primary Group ID> Allowed To Delegate To:<Allowed To Delegate To> Old UAC Value:<Old UAC Value> New UAC Value:<New UAC Value> User Account Control: Account Disabled 'Password Not Required' - Enabled 'Normal Account' - Enabled User Parameters:<User Parameters> SID History:<SID History> Logon Hours:<Logon Hours> Additional Information: Privileges |
| Event Information | Cause : This event is logged when an user account was created in Active Directory of a Domain Controller. Resolution : This is an information event and no user account is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.