Windows Event ID 4706 – Microsoft-Windows-Security-Auditing: Directory Service Object Created

Start by examining the specific 4706 event to understand what object was created and by whom.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4706 using the filter option
4. Double-click the event to view detailed information
5. Review the Subject section to identify who created the object
6. Check the Object section for the Distinguished Name and Object Class
7. Note the Process Information to see which application performed the creation

Use PowerShell to query multiple 4706 events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4706} -MaxEvents 50 | Select-Object TimeCreated, @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[0] -replace '.*Account Name:\s*',''}}, @{Name='ObjectDN';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Object DN:*'})[0] -replace '.*Object DN:\s*',''}}

Investigate unusual creation patterns that might indicate unauthorized activity or system issues.

1. Query events from the last 24 hours to identify recent creations:

$StartTime = (Get-Date).AddDays(-1)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4706; StartTime=$StartTime}
$Events | ForEach-Object {
    $Message = $_.Message
    $User = ($Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[0] -replace '.*Account Name:\s*',''
    $ObjectDN = ($Message -split '\n' | Where-Object {$_ -like '*Object DN:*'})[0] -replace '.*Object DN:\s*',''
    $ObjectClass = ($Message -split '\n' | Where-Object {$_ -like '*Object Class:*'})[0] -replace '.*Object Class:\s*',''
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $User
        ObjectDN = $ObjectDN
        ObjectClass = $ObjectClass
    }
} | Sort-Object TimeCreated

2. Group creations by user to identify bulk operations:

$Events | Group-Object User | Sort-Object Count -Descending | Select-Object Name, Count

3. Filter for specific object types like user accounts:

$Events | Where-Object {$_.ObjectClass -eq 'user'} | Format-Table TimeCreated, User, ObjectDN -AutoSize

Correlate 4706 events with other Active Directory audit events to build a complete picture of directory changes.

1. Check for related events that occurred around the same time:

$TargetTime = Get-Date '2026-03-18 14:30:00'
$TimeWindow = 300 # 5 minutes
$StartTime = $TargetTime.AddSeconds(-$TimeWindow)
$EndTime = $TargetTime.AddSeconds($TimeWindow)

# Get related AD events
$RelatedEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4662,4706,4728,4729,4732,4733,4756,4757
    StartTime=$StartTime
    EndTime=$EndTime
} | Sort-Object TimeCreated

2. Examine Directory Service logs for additional context:

Get-WinEvent -FilterHashtable @{LogName='Directory Service'; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.LevelDisplayName -eq 'Warning' -or $_.LevelDisplayName -eq 'Error'}

3. Check the Active Directory Web Services log for LDAP operations:

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-ActiveDirectory_WebServices/Operational'; StartTime=$StartTime; EndTime=$EndTime}

Determine the source and legitimacy of object creation by analyzing process information and network context.

1. Extract process information from 4706 events to identify creation tools:

$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4706} -MaxEvents 100
$Events | ForEach-Object {
    $Message = $_.Message
    $ProcessName = ($Message -split '\n' | Where-Object {$_ -like '*Process Name:*'})[0] -replace '.*Process Name:\s*',''
    $ProcessId = ($Message -split '\n' | Where-Object {$_ -like '*Process ID:*'})[0] -replace '.*Process ID:\s*',''
    $ClientAddress = ($Message -split '\n' | Where-Object {$_ -like '*Client Address:*'})[0] -replace '.*Client Address:\s*',''
    
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        ProcessName = $ProcessName
        ProcessId = $ProcessId
        ClientAddress = $ClientAddress
        User = ($Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[0] -replace '.*Account Name:\s*',''
    }
} | Group-Object ProcessName | Sort-Object Count -Descending

2. Verify the legitimacy of creation processes by checking digital signatures:

# Check common AD management tools
$CommonTools = @(
    'C:\Windows\System32\dsa.exe',
    'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe',
    'C:\Program Files\Microsoft\Exchange Server\V15\Bin\MSExchangeADTopology.exe'
)

$CommonTools | ForEach-Object {
    if (Test-Path $_) {
        Get-AuthenticodeSignature $_ | Select-Object Path, Status, SignerCertificate
    }
}

3. Analyze client addresses for remote creation attempts:

# Identify non-local object creations
$RemoteCreations = $Events | Where-Object {$_.ClientAddress -ne '::1' -and $_.ClientAddress -ne '127.0.0.1' -and $_.ClientAddress -ne '-'}
$RemoteCreations | Group-Object ClientAddress | Sort-Object Count -Descending

Set up proactive monitoring to detect suspicious object creation patterns and automate response procedures.

1. Create a scheduled task to monitor for unusual 4706 patterns:

# Create monitoring script
$MonitoringScript = @'
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4706; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue
if ($Events.Count -gt 10) {
    $Alert = "High volume of AD object creation detected: $($Events.Count) objects in the last hour"
    Write-EventLog -LogName Application -Source "AD Monitor" -EventId 1001 -EntryType Warning -Message $Alert
    # Send email alert here if configured
}
'@

$MonitoringScript | Out-File -FilePath 'C:\Scripts\Monitor-ADCreation.ps1' -Encoding UTF8

2. Configure Windows Event Forwarding to centralize 4706 events:

# On the collector server, create subscription
wecutil cs ADObjectCreation.xml

Create the subscription XML file:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>ADObjectCreation</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Forward AD Object Creation Events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <ConfigurationMode>Normal</ConfigurationMode>
    <Query>
        <![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="Security">*[System[EventID=4706]]</Select>
            </Query>
        </QueryList>
        ]]>
    </Query>
</Subscription>

3. Set up custom event log filtering for security operations:

# Create custom view in Event Viewer
$CustomViewXML = @'
<ViewerConfig>
    <QueryConfig>
        <QueryParams>
            <UserQuery />
        </QueryParams>
        <QueryNode>
            <Name>AD Object Creation Monitoring</Name>
            <QueryList>
                <Query Id="0" Path="Security">
                    <Select>*[System[EventID=4706]]</Select>
                </Query>
            </QueryList>
        </QueryNode>
    </QueryConfig>
</ViewerConfig>
'@

$CustomViewXML | Out-File -FilePath "$env:USERPROFILE\Desktop\ADObjectCreation.xml"