A user account was created

// EVENT DEFINITION:

A user account was created in Active Directory or the local Security Accounts Manager (SAM).

// DETAILED TELEMETRY & CONTEXT:

Event ID 4720 logs the creation of any new user account within Active Directory or local Windows systems. It identifies the Target Account Name alongside the Subject Account (the administrator or service account that created it). It also enumerates the initial attributes assigned during provisioning, such as User Account Control flags, password expiration requirements, and directory paths.

[ ! ]Failure Reason / Root Cause Analysis

Routine administrative onboarding, automated provisioning scripts, or unauthorized persistence establishment by a malicious actor creating a backdoor account.

Operational Metadata & Applicability

Log Category:Account Management

Audit Type Classification:Success Audit

Supported Operating Systems:Windows Server 2016, 2019, 2022 / Windows Client 10, 11 (Enterprise / Pro)

Threat Hunting Keywords:

account creatednew userprovisioningbackdoorsamactive directoryonboarding

MITRE ATT&CK Framework Alignment

T1136.002

Create Account: Domain AccountTactic: Persistence

T1136.001

Create Account: Local AccountTactic: Persistence

Mitigation Playbook & Recommended SOC Actions

•Verify the Subject Account name against approved IT helpdesk ticketing logs for newly onboarded employees.
•Flag any accounts created outside of standard business hours or by non-administrative user identities.
•Check subsequent events for group membership modifications (such as Event ID 4728 or 4732) assigning high privileges to this new account.

Representative Windows Event XML Schema

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4720</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2026-07-17T09:54:44.299Z" />
    <EventRecordID>1048576</EventRecordID>
    <Correlation />
    <Execution ProcessID="612" ThreadID="1024" />
    <Channel>Security</Channel>
    <Computer>DC01.enterprise.internal</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">SYSTEM</Data>
    <Data Name="SubjectDomainName">NT AUTHORITY</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <!-- Event telemetry fields specific to A user account was created -->
  </EventData>
</Event>

Correlated / Related Security Event IDs

Need to export or view this event without styling/layout wrappers?

Open Simple Plain Detail Page →

ADVERTISEMENT / SPONSORED RESERVATION (728x90)