Windows Event ID 4700 – Security: A User Account was Created

Open Event Viewer and navigate to the Security log to examine the event details:

1. Press Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. Filter the log by Event ID 4700 using the Filter Current Log option
4. Double-click on the Event ID 4700 entry to view detailed information
5. Review the Subject section to identify who created the account
6. Examine the Target Account section for new account details
7. Check the Additional Information section for account attributes and flags
8. Note the timestamp to correlate with other security events if needed

The event details will show the Security ID, Account Name, Account Domain, and Logon ID of both the creator and the newly created account.

Use PowerShell to programmatically retrieve and analyze Event ID 4700 occurrences:

# Get recent account creation events
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4700} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

# Filter events by specific time range
$StartTime = (Get-Date).AddDays(-7)
$EndTime = Get-Date
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4700; StartTime=$StartTime; EndTime=$EndTime}

# Extract specific information from event data
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4700} -MaxEvents 10 | ForEach-Object {
    $Event = [xml]$_.ToXml()
    $EventData = $Event.Event.EventData.Data
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SubjectUserName = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
        TargetUserName = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
        TargetDomain = ($EventData | Where-Object {$_.Name -eq 'TargetDomainName'}).'#text'
    }
}

This approach allows for automated monitoring and reporting of account creation activities across multiple systems.

Ensure proper audit policy configuration to capture Event ID 4700 consistently:

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management and locate Audit User Account Management
4. Configure the policy for both Success and Failure events
5. Apply the policy and run gpupdate /force to refresh settings

Verify the current audit settings using command line:

# Check current audit policy settings
auditpol /get /category:"Account Management"

# Set audit policy for user account management
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

# Verify the configuration
auditpol /get /subcategory:"User Account Management"

Set up automated monitoring for Event ID 4700 to detect unauthorized account creation:

1. Create a PowerShell script for continuous monitoring:

# Create monitoring script
$ScriptBlock = {
    Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4700" -Action {
        $Event = $Event.SourceEventArgs.NewEvent
        $Message = "New user account created: $($Event.InsertionStrings[5]) by $($Event.InsertionStrings[1])"
        Write-EventLog -LogName Application -Source "AccountMonitor" -EventId 1001 -Message $Message -EntryType Information
        # Send email or trigger alert system here
    }
}

# Register the event subscription
Invoke-Command -ScriptBlock $ScriptBlock

2. Configure Windows Task Scheduler to run monitoring scripts
3. Set up email notifications or SIEM integration
4. Create custom event log source for monitoring alerts:

# Create custom event source (run as administrator)
New-EventLog -LogName Application -Source "AccountMonitor"

# Test the custom logging
Write-EventLog -LogName Application -Source "AccountMonitor" -EventId 1001 -Message "Account monitoring initialized" -EntryType Information

Perform comprehensive forensic analysis of Event ID 4700 in conjunction with related security events:

1. Correlate with related events for complete timeline:

# Get comprehensive account management events
$AccountEvents = @(4720, 4722, 4724, 4725, 4726, 4738, 4740, 4767, 4781)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$AccountEvents; StartTime=(Get-Date).AddDays(-1)} | 
    Sort-Object TimeCreated | 
    Select-Object TimeCreated, Id, LevelDisplayName, @{Name='EventDescription';Expression={
        switch($_.Id) {
            4720 {'User account was created'}
            4722 {'User account was enabled'}
            4724 {'An attempt was made to reset an account password'}
            4725 {'User account was disabled'}
            4726 {'User account was deleted'}
            4738 {'User account was changed'}
            4740 {'User account was locked out'}
            4767 {'User account was unlocked'}
            4781 {'The name of an account was changed'}
        }
    }}

# Extract and analyze account creation patterns
$CreationEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4700; StartTime=(Get-Date).AddDays(-30)}
$CreationEvents | ForEach-Object {
    $EventXml = [xml]$_.ToXml()
    $EventData = $EventXml.Event.EventData.Data
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        Creator = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
        CreatedAccount = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
        Domain = ($EventData | Where-Object {$_.Name -eq 'TargetDomainName'}).'#text'
        WorkstationName = ($EventData | Where-Object {$_.Name -eq 'WorkstationName'}).'#text'
    }
} | Group-Object Creator | Sort-Object Count -Descending

2. Export findings for compliance reporting:

# Generate compliance report
$Report = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4700; StartTime=(Get-Date).AddDays(-90)} | 
    ForEach-Object {
        $EventXml = [xml]$_.ToXml()
        $EventData = $EventXml.Event.EventData.Data
        [PSCustomObject]@{
            Timestamp = $_.TimeCreated
            CreatedBy = ($EventData | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
            AccountName = ($EventData | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
            AccountSID = ($EventData | Where-Object {$_.Name -eq 'TargetSid'}).'#text'
            Domain = ($EventData | Where-Object {$_.Name -eq 'TargetDomainName'}).'#text'
        }
    }

$Report | Export-Csv -Path "C:\Reports\AccountCreation_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

This comprehensive analysis helps identify patterns, unauthorized activities, and ensures compliance with security policies.