Windows Event ID 4744 – Microsoft-Windows-Security-Auditing: Computer Account Created

Start by examining the complete event details to understand the context of the computer account creation.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4744 using Filter Current Log
4. Double-click the event to view detailed information
5. Review the Subject section to identify who created the account:
   • Security ID: The SID of the account that performed the action
   • Account Name: The username that created the computer account
   • Account Domain: The domain of the creating account
   • Logon ID: Session identifier for correlation with other events
6. Examine the New Computer Account section:
   • Security ID: The SID assigned to the new computer account
   • Account Name: The NetBIOS name of the computer
   • Account Domain: The domain where the account was created
7. Check Additional Information for privileges used and source workstation

Use PowerShell to efficiently search and analyze computer account creation events across multiple domain controllers.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent computer account creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4744} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Extract specific details from the events:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4744} -MaxEvents 100
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $SubjectUserName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       $TargetUserName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       $WorkstationName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'WorkstationName'} | Select-Object -ExpandProperty '#text'
       
       Write-Output "Time: $($Event.TimeCreated) | Creator: $SubjectUserName | Computer: $TargetUserName | Workstation: $WorkstationName"
   }

4. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4744; StartTime=$StartTime; EndTime=$EndTime}

5. Query multiple domain controllers simultaneously:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Invoke-Command -ComputerName $DC.Name -ScriptBlock {
           Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4744} -MaxEvents 10 -ErrorAction SilentlyContinue
       }
   }

When Event ID 4744 appears unexpectedly, follow these steps to investigate potential security incidents.

1. Identify the source of the computer account creation by examining the Subject fields in the event
2. Verify if the creating user has legitimate permissions:

   Get-ADUser -Identity "SuspiciousUser" -Properties MemberOf | Select-Object -ExpandProperty MemberOf

3. Check the computer account details in Active Directory:

   Get-ADComputer -Identity "NewComputerName" -Properties Created, CreatedBy, LastLogonDate, OperatingSystem

4. Review related authentication events around the same time:

   $TimeWindow = (Get-Date $Event.TimeCreated).AddMinutes(-30)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=$TimeWindow; EndTime=(Get-Date $Event.TimeCreated).AddMinutes(30)} | Where-Object {$_.Message -like "*$SubjectUserName*"}

5. Examine the source workstation mentioned in the event:
   • Verify if the workstation is a known administrative machine
   • Check for signs of compromise on the source system
   • Review network access logs for unusual activity
6. Correlate with other security events:

   # Look for privilege escalation events
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Where-Object {$_.TimeCreated -gt $TimeWindow -and $_.Message -like "*$SubjectUserName*"}

7. If unauthorized, immediately disable the computer account:

   Disable-ADAccount -Identity "SuspiciousComputerName"

Set up proactive monitoring to detect and alert on computer account creation events in real-time.

1. Configure Advanced Audit Policy on all domain controllers:

   # Enable computer account management auditing
   auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable

2. Verify the audit policy is applied:

   auditpol /get /subcategory:"Computer Account Management"

3. Create a custom Event Viewer filter for monitoring:
   • Open Event Viewer → Custom Views
   • Right-click and select Create Custom View
   • Set Event Level to Information
   • Enter Event ID: 4744
   • Select Security log
   • Save as "Computer Account Creation Monitor"
4. Set up PowerShell-based alerting script:

   # Save as Monitor-ComputerAccountCreation.ps1
   $Action = {
       $Event = $Event.SourceEventArgs.NewEvent
       $XML = [xml]$Event.ToXml()
       $ComputerName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
       $Creator = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
       
       # Send email alert or log to SIEM
       Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1001 -Message "New computer account created: $ComputerName by $Creator"
   }
   
   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=4744" -Action $Action

5. Configure Windows Event Forwarding (WEF) for centralized collection:
   • Create a custom subscription on the collector server
   • Configure source computers to forward Security events
   • Filter for Event ID 4744 in the subscription
6. Integrate with SIEM solutions by configuring log forwarding to your security platform

Perform comprehensive analysis of computer account creation patterns for security investigations and compliance requirements.

1. Export computer account creation events for analysis:

   # Export last 30 days of events to CSV
   $StartDate = (Get-Date).AddDays(-30)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4744; StartTime=$StartDate}
   $Results = @()
   
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $Results += [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           Creator = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
           CreatorDomain = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'}).'#text'
           ComputerName = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
           ComputerSID = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetSid'}).'#text'
           Workstation = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'WorkstationName'}).'#text'
           LogonId = ($XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectLogonId'}).'#text'
       }
   }
   
   $Results | Export-Csv -Path "C:\Temp\ComputerAccountCreation.csv" -NoTypeInformation

2. Analyze patterns and anomalies:

   # Group by creator to identify bulk operations
   $Results | Group-Object Creator | Sort-Object Count -Descending | Select-Object Name, Count
   
   # Identify after-hours creations
   $Results | Where-Object {$_.TimeCreated.Hour -lt 8 -or $_.TimeCreated.Hour -gt 18} | Format-Table
   
   # Find weekend activity
   $Results | Where-Object {$_.TimeCreated.DayOfWeek -eq 'Saturday' -or $_.TimeCreated.DayOfWeek -eq 'Sunday'}

3. Cross-reference with Active Directory to verify current status:

   foreach ($Computer in $Results.ComputerName) {
       try {
           $ADComputer = Get-ADComputer -Identity $Computer -Properties LastLogonDate, Enabled
           Write-Output "$Computer - Enabled: $($ADComputer.Enabled) - Last Logon: $($ADComputer.LastLogonDate)"
       } catch {
           Write-Output "$Computer - Not found in AD (possibly deleted)"
       }
   }

4. Generate compliance reports:

   # Create monthly summary report
   $MonthlyReport = $Results | Group-Object {$_.TimeCreated.ToString("yyyy-MM")} | ForEach-Object {
       [PSCustomObject]@{
           Month = $_.Name
           TotalCreations = $_.Count
           UniqueCreators = ($_.Group.Creator | Sort-Object -Unique).Count
           AfterHours = ($_.Group | Where-Object {$_.TimeCreated.Hour -lt 8 -or $_.TimeCreated.Hour -gt 18}).Count
       }
   }
   
   $MonthlyReport | Format-Table -AutoSize

5. Document findings for audit purposes:
   • Create executive summary of computer account creation trends
   • Identify any policy violations or security concerns
   • Recommend improvements to access controls or monitoring
   • Archive evidence files with proper chain of custody