Windows Event ID 4741 – Microsoft-Windows-Security-Auditing: Computer Account Created

Start by examining the complete event details to understand the context of the computer account creation.

1. Open Event Viewer on the domain controller where the event was logged
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4741 using the filter option or search functionality
4. Double-click the event to view detailed information including:
   • Subject: Shows who created the account (Account Name, Account Domain, Logon ID)
   • New Computer Account: Displays the created account name and SID
   • Attributes: Lists the computer account properties set during creation
5. Note the timestamp to correlate with other domain join activities or administrative actions
6. Check if the creating user account has appropriate permissions for computer account creation

Use PowerShell to efficiently query and analyze computer account creation events across multiple domain controllers.

1. Open PowerShell as Administrator on a domain controller or system with RSAT installed
2. Query recent computer account creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741; StartTime=$StartTime; EndTime=$EndTime}

4. Extract specific details from the event data:

   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741} -MaxEvents 20 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ComputerAccount = $Event.Event.EventData.Data[0].'#text'
           CreatedBy = $Event.Event.EventData.Data[4].'#text'
           Domain = $Event.Event.EventData.Data[5].'#text'
       }
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741} | Export-Csv -Path "C:\Temp\ComputerAccountCreation.csv" -NoTypeInformation

Cross-reference Event ID 4741 with related domain join events to get the complete picture of system additions to the domain.

1. Query for related domain join events on the same domain controller:

   $ComputerName = "WORKSTATION01"
   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=@(4741,4742,4743)} | Where-Object {$_.Message -like "*$ComputerName*"}

2. Check System log for corresponding Netlogon events:

   Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Netlogon'} -MaxEvents 100 | Where-Object {$_.Message -like "*$ComputerName*"}

3. Review Directory Service log for additional context:

   Get-WinEvent -FilterHashtable @{LogName='Directory Service'} -MaxEvents 50 | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1)}

4. Examine DNS registration events that typically follow domain joins:

   Get-WinEvent -FilterHashtable @{LogName='DNS Server'; ID=@(2,6527,6528)} | Where-Object {$_.Message -like "*$ComputerName*"}

5. Create a timeline of related events:

   $Events = @()
   $Events += Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741} -MaxEvents 10
   $Events += Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Netlogon'} -MaxEvents 10
   $Events | Sort-Object TimeCreated | Select-Object TimeCreated, LogName, Id, Message

When Event ID 4741 appears unexpectedly, investigate potential security implications and unauthorized account creation.

1. Identify the user account that created the computer account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741} -MaxEvents 20 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       $CreatedBy = $Event.Event.EventData.Data[4].'#text'
       $ComputerAccount = $Event.Event.EventData.Data[0].'#text'
       Write-Output "Computer: $ComputerAccount created by: $CreatedBy at $($_.TimeCreated)"
   }

2. Verify the creating user's permissions in Active Directory:

   Import-Module ActiveDirectory
   $UserAccount = "DOMAIN\username"
   Get-ADUser -Identity $UserAccount -Properties MemberOf | Select-Object Name, MemberOf

3. Check if the computer account still exists and its current status:

   $ComputerName = "SUSPICIOUS-PC"
   Get-ADComputer -Identity $ComputerName -Properties Created, LastLogonDate, OperatingSystem

4. Review recent logon events for the creating user account:

   Get-WinEvent -FilterHashtable @{LogName='Security'; ID=@(4624,4625)} | Where-Object {$_.Message -like "*username*"} | Select-Object TimeCreated, Id, Message

5. Examine Group Policy and delegation settings:

   Get-ADOrganizationalUnit -Filter * -Properties gPLink | Where-Object {$_.gPLink -ne $null} | Select-Object Name, DistinguishedName

6. If unauthorized creation is confirmed, disable the computer account immediately:

   Disable-ADAccount -Identity "SUSPICIOUS-PC"
   Set-ADComputer -Identity "SUSPICIOUS-PC" -Description "Disabled due to unauthorized creation - $(Get-Date)"

Set up proactive monitoring to detect and alert on computer account creation events for security and compliance purposes.

1. Create a custom Windows Event Forwarding subscription to centralize Event ID 4741:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>ComputerAccountCreation</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Description>Monitor computer account creation events</Description>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[EventID=4741]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>

2. Configure a scheduled task to run monitoring script:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-ComputerAccountCreation.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At "09:00AM"
   Register-ScheduledTask -TaskName "Monitor Computer Account Creation" -Action $Action -Trigger $Trigger

3. Create a PowerShell monitoring script that checks for new events:

   # Monitor-ComputerAccountCreation.ps1
   $LastCheck = (Get-Date).AddDays(-1)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4741; StartTime=$LastCheck}
   
   foreach ($Event in $Events) {
       $EventXML = [xml]$Event.ToXml()
       $ComputerAccount = $EventXML.Event.EventData.Data[0].'#text'
       $CreatedBy = $EventXML.Event.EventData.Data[4].'#text'
       
       # Send alert email or write to monitoring system
       Write-EventLog -LogName Application -Source "ComputerAccountMonitor" -EventId 1001 -Message "Computer account $ComputerAccount created by $CreatedBy"
   }

4. Set up Windows Event Log alerts using Task Scheduler:

   $TaskAction = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Send-MailMessage -To 'admin@company.com' -From 'alerts@company.com' -Subject 'Computer Account Created' -Body 'Event ID 4741 detected' -SmtpServer 'mail.company.com'"
   $TaskTrigger = New-CimInstance -ClassName MSFT_TaskEventTrigger -Namespace Root/Microsoft/Windows/TaskScheduler -ClientOnly
   $TaskTrigger.Subscription = '<QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[EventID=4741]]</Select></Query></QueryList>'
   Register-ScheduledTask -TaskName "Alert on Computer Account Creation" -Action $TaskAction -Trigger $TaskTrigger

5. Configure audit policy to ensure Event ID 4741 is logged:

   auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable