Windows Event ID 4761 – Microsoft-Windows-Security-Auditing: Computer Account Created

Start by examining the event details to understand the context of the computer account creation.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4761 using the filter option
4. Double-click on a recent Event ID 4761 entry
5. Review the following key fields in the event details:
   • Subject: Shows who created the account (Security ID, Account Name, Domain)
   • New Computer Account: Displays the created computer name and domain
   • Attributes: Lists the distinguished name and other account properties
6. Check the timestamp to correlate with known system activities
7. Note the Logon ID to trace related authentication events

Use PowerShell to efficiently query and analyze Event ID 4761 occurrences across your domain controllers.

1. Open PowerShell as Administrator on a domain controller
2. Query recent computer account creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4761} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='Computer';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*New Computer Account:*'} | Select-Object -First 1) -replace '.*Account Name:\s*(.*)','$1'}}, @{Name='Creator';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Subject:*'} -A 3 | Where-Object {$_ -like '*Account Name:*'}) -replace '.*Account Name:\s*(.*)','$1'}}

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4761; StartTime=$StartTime}
   $Events | Format-Table TimeCreated, Id, MachineName -AutoSize

4. Export results for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4761} -MaxEvents 100 | Export-Csv -Path "C:\Temp\ComputerAccountCreation.csv" -NoTypeInformation

5. Search for specific computer account patterns:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4761} | Where-Object {$_.Message -like '*WORKSTATION*'} | Select-Object TimeCreated, Message

Cross-reference Event ID 4761 with other Active Directory events to build a complete picture of computer account management activities.

1. Check Directory Service logs for additional context:

   Get-WinEvent -FilterHashtable @{LogName='Directory Service'; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Message -like '*computer*'}

2. Look for related security events around the same timeframe:

   $TimeWindow = 5 # minutes
   $Event4761 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4761} -MaxEvents 1
   $StartTime = $Event4761.TimeCreated.AddMinutes(-$TimeWindow)
   $EndTime = $Event4761.TimeCreated.AddMinutes($TimeWindow)
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Id -in @(4624,4625,4768,4769)} | Format-Table TimeCreated, Id, Message -Wrap

3. Query DNS logs for computer registration:

   Get-WinEvent -FilterHashtable @{LogName='DNS Server'} | Where-Object {$_.Message -like '*computer_name*'}

4. Check Group Policy logs if computer accounts are being added to specific OUs:

   Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object {$_.Id -eq 1006 -and $_.Message -like '*Group Policy*'}

5. Use Active Directory PowerShell module to verify account details:

   Import-Module ActiveDirectory
   Get-ADComputer -Filter "Created -gt '$((Get-Date).AddDays(-1).ToString('yyyy-MM-dd'))'" -Properties Created, CreatedBy | Format-Table Name, Created, CreatedBy

Set up comprehensive monitoring to track computer account creation patterns and detect anomalies.

1. Create a custom Windows Event Forwarding subscription:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
     <SubscriptionId>ComputerAccountCreation</SubscriptionId>
     <SubscriptionType>SourceInitiated</SubscriptionType>
     <Description>Monitor computer account creation events</Description>
     <Enabled>true</Enabled>
     <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
     <Query><![CDATA[
       <QueryList>
         <Query Id="0">
           <Select Path="Security">*[System[EventID=4761]]</Select>
         </Query>
       </QueryList>
     ]]></Query>
   </Subscription>

2. Configure PowerShell-based alerting script:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'Security' AND TargetInstance.EventCode = 4761" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       $Message = "Computer account created: $($Event.Message)"
       Write-EventLog -LogName Application -Source "CustomMonitoring" -EventId 1001 -Message $Message
       # Add email notification or SIEM integration here
   }

3. Set up scheduled task to analyze patterns:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\AnalyzeComputerCreation.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At "09:00AM"
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
   Register-ScheduledTask -TaskName "ComputerAccountAnalysis" -Action $Action -Trigger $Trigger -Settings $Settings

4. Create baseline metrics for normal computer account creation rates
5. Configure SIEM integration to correlate with other security events

Perform detailed forensic analysis when investigating suspicious computer account creation activities.

1. Extract detailed event information for forensic analysis:

   $SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4761; StartTime=(Get-Date).AddDays(-30)}
   $DetailedAnalysis = foreach ($Event in $SuspiciousEvents) {
       $EventXML = [xml]$Event.ToXml()
       [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           SubjectUserSid = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserSid'} | Select-Object -ExpandProperty '#text'
           SubjectUserName = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TargetUserName = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           TargetDomainName = $EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetDomainName'} | Select-Object -ExpandProperty '#text'
       }
   }
   $DetailedAnalysis | Export-Csv -Path "C:\Forensics\Event4761_Analysis.csv" -NoTypeInformation

2. Correlate with authentication events to trace the attack chain:

   $TimeRange = 30 # minutes before and after
   foreach ($Event in $SuspiciousEvents) {
       $StartTime = $Event.TimeCreated.AddMinutes(-$TimeRange)
       $EndTime = $Event.TimeCreated.AddMinutes($TimeRange)
       $RelatedEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime; Id=@(4624,4625,4648,4672)}
       Write-Output "Events around $($Event.TimeCreated):"
       $RelatedEvents | Format-Table TimeCreated, Id, @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'} | Select-Object -First 1) -replace '.*Account Name:\s*(.*)','$1'}}
   }

3. Check for privilege escalation indicators:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7)} | Format-Table TimeCreated, @{Name='User';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Subject:*'} -A 3 | Where-Object {$_ -like '*Account Name:*'}) -replace '.*Account Name:\s*(.*)','$1'}}

4. Generate comprehensive incident report:

   $IncidentReport = @{
       'Investigation_Date' = Get-Date
       'Suspicious_Events' = $SuspiciousEvents.Count
       'Affected_Computers' = ($DetailedAnalysis | Select-Object -Unique TargetUserName).Count
       'Unique_Creators' = ($DetailedAnalysis | Select-Object -Unique SubjectUserName).Count
       'Time_Range' = "$($SuspiciousEvents | Measure-Object TimeCreated -Minimum | Select-Object -ExpandProperty Minimum) to $($SuspiciousEvents | Measure-Object TimeCreated -Maximum | Select-Object -ExpandProperty Maximum)"
   }
   $IncidentReport | ConvertTo-Json | Out-File "C:\Forensics\Event4761_IncidentReport.json"

5. Document findings and preserve evidence for potential legal proceedings