Windows Event ID 4720 – Microsoft-Windows-Security-Auditing: User Account Created

Start by examining the event details to understand what account was created and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4720 in the Event IDs field and click OK
5. Double-click on a 4720 event to view detailed information
6. Review key fields including:
   • Subject: Who created the account
   • New Account: Details of the created account
   • Attributes: Account properties set during creation
   • Additional Information: Privileges and account control flags

Use PowerShell to efficiently search and analyze account creation events across multiple systems.

1. Open PowerShell as Administrator
2. Query recent account creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. For more detailed analysis, extract specific fields:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           CreatedBy = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           NewAccount = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           Domain = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetDomainName'} | Select-Object -ExpandProperty '#text'
       }
   }

4. Filter events by date range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720; StartTime=$StartTime; EndTime=$EndTime}

Investigate unusual account creation patterns that might indicate security issues or process problems.

1. Create a PowerShell script to analyze creation patterns:

   # Analyze account creation by creator
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720} -MaxEvents 1000
   $CreationStats = $Events | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           Creator = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TimeCreated = $_.TimeCreated
           NewAccount = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       }
   } | Group-Object Creator | Sort-Object Count -Descending
   
   $CreationStats | Format-Table Name, Count

2. Check for after-hours account creation:

   # Find account creation outside business hours (before 8 AM or after 6 PM)
   $Events | Where-Object {
       $_.TimeCreated.Hour -lt 8 -or $_.TimeCreated.Hour -gt 18
   } | Format-Table TimeCreated, Message -Wrap

3. Look for rapid account creation (potential bulk operations):

   # Group events by 5-minute intervals to find bulk creation
   $Events | Group-Object {$_.TimeCreated.ToString('yyyy-MM-dd HH:mm').Substring(0,16)} | Where-Object {$_.Count -gt 5} | Format-Table Name, Count

In domain environments, correlate Event ID 4720 with other Active Directory events for complete visibility.

1. Check Directory Service logs on domain controllers:

   Get-WinEvent -FilterHashtable @{LogName='Directory Service'; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like '*user*create*'}

2. Query Active Directory for recently created accounts:

   Import-Module ActiveDirectory
   $Yesterday = (Get-Date).AddDays(-1)
   Get-ADUser -Filter {whenCreated -gt $Yesterday} -Properties whenCreated, CreatedBy | Select-Object Name, whenCreated, DistinguishedName

3. Compare Security log events with AD creation timestamps:

   # Get both security events and AD data
   $SecurityEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720; StartTime=$Yesterday}
   $ADUsers = Get-ADUser -Filter {whenCreated -gt $Yesterday} -Properties whenCreated
   
   # Cross-reference the data
   foreach ($user in $ADUsers) {
       $matchingEvent = $SecurityEvents | Where-Object {$_.Message -like "*$($user.Name)*"}
       if ($matchingEvent) {
           Write-Host "Match found: $($user.Name) created at $($user.whenCreated)"
       }
   }

4. Check for orphaned security events (events without corresponding AD objects):

   # This might indicate deleted accounts or failed creations
   $SecurityEvents | ForEach-Object {
       $xml = [xml]$_.ToXml()
       $accountName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       try {
           Get-ADUser $accountName -ErrorAction Stop
       } catch {
           Write-Warning "Account $accountName from event not found in AD"
       }
   }

Set up proactive monitoring to detect unauthorized or suspicious account creation activities.

1. Create a scheduled task to monitor account creation:

   # Create monitoring script
   $ScriptContent = @'
   $Events = Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4720; StartTime=(Get-Date).AddMinutes(-15)} -ErrorAction SilentlyContinue
   if ($Events) {
       $Events | ForEach-Object {
           $xml = [xml]$_.ToXml()
           $creator = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "SubjectUserName"} | Select-Object -ExpandProperty "#text"
           $newAccount = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "TargetUserName"} | Select-Object -ExpandProperty "#text"
           Write-EventLog -LogName Application -Source "Account Monitor" -EventId 1001 -Message "New account created: $newAccount by $creator at $($_.TimeCreated)"
       }
   }
   '@
   $ScriptContent | Out-File -FilePath "C:\Scripts\MonitorAccountCreation.ps1"

2. Register the script as a scheduled task:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\MonitorAccountCreation.ps1"
   $Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
   Register-ScheduledTask -TaskName "Monitor Account Creation" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

3. Configure Windows Event Forwarding for centralized monitoring:

   # Create custom event subscription XML
   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>AccountCreationMonitoring</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Forward account creation events</Description>
       <Enabled>true</Enabled>
       <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
       <ConfigurationMode>Normal</ConfigurationMode>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4720]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

4. Set up email alerts for suspicious patterns:

   # Advanced monitoring with email alerts
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720; StartTime=(Get-Date).AddHours(-1)}
   if ($Events.Count -gt 10) {
       $Body = "Warning: $($Events.Count) accounts created in the last hour. This may indicate bulk provisioning or suspicious activity."
       Send-MailMessage -To "security@company.com" -From "monitoring@company.com" -Subject "High Volume Account Creation Alert" -Body $Body -SmtpServer "mail.company.com"
   }