Windows EventInformation
Windows Event ID 5633 – Security-Auditing: User Account Management Audit Event
Event ID 5633 tracks user account management operations in Windows security auditing, firing when user accounts are created, modified, or deleted through administrative actions.
