Windows Event ID 4745 – Microsoft-Windows-Security-Auditing: Computer Account Created

Start by examining the event details to understand who created the computer account and when.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4745 using the filter option
4. Double-click the event to view details including:
   • Subject: User account that created the computer
   • Computer Account: Name and SID of the new computer
   • Attributes: DN, SAM account name, and OU placement
5. Note the timestamp and correlate with any scheduled maintenance or deployment activities

Use PowerShell to retrieve and analyze computer account creation events across multiple domain controllers.

1. Run PowerShell as Administrator on a domain controller or management workstation
2. Query recent computer account creations:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4745} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='Computer';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'})[1] -replace '.*Account Name:\s*',''}}, @{Name='Creator';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Subject:*' -and $_ -like '*Account Name:*'})[0] -replace '.*Account Name:\s*',''}} | Format-Table -AutoSize

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4745; StartTime=$StartTime}
   $Events | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           ComputerName = $EventXML.Event.EventData.Data[5].'#text'
           CreatedBy = $EventXML.Event.EventData.Data[1].'#text'
           OU = $EventXML.Event.EventData.Data[7].'#text'
       }
   } | Format-Table -AutoSize

4. Export results for further analysis:

   $Events | Export-Csv -Path "C:\Temp\ComputerAccountCreation.csv" -NoTypeInformation

Ensure proper audit policies are configured to capture computer account management events.

1. Check current audit policy settings:

   auditpol /get /subcategory:"Computer Account Management"

2. If not enabled, configure the audit policy:

   auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable

3. Verify Group Policy settings in Group Policy Management Console:
4. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
5. Expand Account Management and check Audit Computer Account Management
6. Ensure both Success and Failure are configured
7. Force Group Policy update:

   gpupdate /force

When Event 4745 appears unexpectedly, investigate potential security implications.

1. Identify the source of the computer account creation:

   $SuspiciousEvent = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4745} -MaxEvents 1
   $EventXML = [xml]$SuspiciousEvent.ToXml()
   $CreatorSID = $EventXML.Event.EventData.Data[0].'#text'
   $ComputerSID = $EventXML.Event.EventData.Data[4].'#text'

2. Check if the creator account has appropriate permissions:

   Get-ADUser -Identity $CreatorSID -Properties MemberOf | Select-Object Name, MemberOf

3. Verify the computer account details:

   Get-ADComputer -Identity $ComputerSID -Properties Created, CreatedBy, DistinguishedName

4. Look for related authentication events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddHours(-2)} | Where-Object {$_.Message -like "*$CreatorSID*"}

5. Check for subsequent computer account modifications:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4741,4743} | Where-Object {$_.Message -like "*$ComputerSID*"}

6. Review network logon events from the new computer account

Set up proactive monitoring for computer account creation events to detect anomalies.

1. Create a scheduled task to monitor Event 4745:

   $Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\Monitor-ComputerAccounts.ps1'
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365)
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   Register-ScheduledTask -TaskName "Monitor Computer Account Creation" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

2. Create the monitoring script at C:\Scripts\Monitor-ComputerAccounts.ps1:

   # Monitor-ComputerAccounts.ps1
   $LastCheck = (Get-Date).AddMinutes(-15)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4745; StartTime=$LastCheck} -ErrorAction SilentlyContinue
   
   if ($Events) {
       foreach ($Event in $Events) {
           $EventXML = [xml]$Event.ToXml()
           $ComputerName = $EventXML.Event.EventData.Data[5].'#text'
           $Creator = $EventXML.Event.EventData.Data[1].'#text'
           
           # Send alert email or log to SIEM
           Write-EventLog -LogName Application -Source "AD Monitor" -EventId 1001 -Message "Computer account $ComputerName created by $Creator"
       }
   }

3. Configure Windows Event Forwarding to centralize logs:

   wecutil cs C:\Config\ComputerAccountSubscription.xml

4. Set up SIEM correlation rules to detect patterns like multiple rapid computer account creations or creations outside business hours
5. Implement threshold-based alerting for unusual volumes of computer account creation events