Windows Event ID 5633 – Security-Auditing: User Account Management Audit Event

Start by examining the specific Event ID 5633 entries to understand what account management operations triggered the events.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 5633 in the Event IDs field and click OK
5. Double-click on Event ID 5633 entries to view detailed information
6. Examine the Subject section to identify who performed the account operation
7. Review the Target Account section to see which user account was affected
8. Check the Changed Attributes section to understand what modifications were made

Use PowerShell to extract and analyze Event ID 5633 entries for comprehensive account management tracking.

1. Open PowerShell as Administrator
2. Query recent Event ID 5633 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5633} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Extract detailed event properties for analysis:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5633} -MaxEvents 100
   $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           TargetUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           TargetSid = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetSid'} | Select-Object -ExpandProperty '#text'
       }
   }

4. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5633; StartTime=$StartTime; EndTime=$EndTime}

Ensure proper audit policy configuration to capture comprehensive user account management events.

1. Open Group Policy Management Console or run gpedit.msc for local policy
2. Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration
3. Expand Account Management and double-click Audit User Account Management
4. Check both Success and Failure to capture all account operations
5. Apply the policy and run gpupdate /force to refresh settings
6. Verify audit policy configuration using command line:

   auditpol /get /subcategory:"User Account Management"

7. Check current audit settings across all categories:

   auditpol /get /category:*

8. Enable specific subcategories if needed:

   auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable

Analyze Event ID 5633 patterns to identify unusual account management activities or potential security issues.

1. Create a PowerShell script to analyze account creation patterns:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5633} -MaxEvents 1000
   $Analysis = $Events | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           Time = $_.TimeCreated
           Subject = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           Target = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           Domain = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetDomainName'} | Select-Object -ExpandProperty '#text'
       }
   }
   $Analysis | Group-Object Subject | Sort-Object Count -Descending

2. Identify accounts created outside business hours:

   $Analysis | Where-Object {$_.Time.Hour -lt 8 -or $_.Time.Hour -gt 18} | Format-Table

3. Check for bulk account creation activities:

   $Analysis | Group-Object @{Expression={$_.Time.Date}} | Where-Object {$_.Count -gt 10}

4. Cross-reference with Active Directory to verify account status:

   Import-Module ActiveDirectory
   $RecentAccounts = $Analysis | Where-Object {$_.Time -gt (Get-Date).AddDays(-1)}
   $RecentAccounts | ForEach-Object {
       try {
           $ADUser = Get-ADUser -Identity $_.Target -Properties Created, Enabled
           [PSCustomObject]@{
               Username = $_.Target
               EventTime = $_.Time
               ADCreated = $ADUser.Created
               Enabled = $ADUser.Enabled
           }
       } catch {
           Write-Warning "Account $($_.Target) not found in AD"
       }
   }

Implement automated monitoring solutions to track Event ID 5633 and alert on suspicious account management activities.

1. Create a scheduled task to monitor account creation events:

   $Action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File C:\Scripts\MonitorAccountCreation.ps1'
   $Trigger = New-ScheduledTaskTrigger -Daily -At '09:00'
   $Principal = New-ScheduledTaskPrincipal -UserID 'SYSTEM' -LogonType ServiceAccount
   Register-ScheduledTask -TaskName 'Monitor-AccountCreation' -Action $Action -Trigger $Trigger -Principal $Principal

2. Create the monitoring script at C:\Scripts\MonitorAccountCreation.ps1:

   # Monitor Account Creation Script
   $Yesterday = (Get-Date).AddDays(-1)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5633; StartTime=$Yesterday}
   
   if ($Events.Count -gt 20) {
       $Subject = "High Volume Account Creation Detected"
       $Body = "$($Events.Count) account management events detected in the last 24 hours"
       Send-MailMessage -To 'admin@company.com' -From 'monitoring@company.com' -Subject $Subject -Body $Body -SmtpServer 'mail.company.com'
   }

3. Configure Windows Event Forwarding for centralized monitoring:

   wecutil cs subscription.xml

4. Create subscription XML file for Event ID 5633 forwarding:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
       <SubscriptionId>AccountManagement</SubscriptionId>
       <SubscriptionType>SourceInitiated</SubscriptionType>
       <Query>
           <![CDATA[
           <QueryList>
               <Query Id="0">
                   <Select Path="Security">*[System[(EventID=5633)]]</Select>
               </Query>
           </QueryList>
           ]]>
       </Query>
   </Subscription>