ZEKASTRA

SecurityAccount management

4720 · A user account was created

Generated every time a new user object is created, on domain controllers, member servers and workstations. Subject fields identify who created it; the remaining fields record the new account's initial attributes.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • SamAccountName
  • UserPrincipalName
  • PasswordLastSet
  • AccountExpires
  • PrimaryGroupId
  • AllowedToDelegateTo
  • NewUacValue
  • SidHistory

02How to use it

Establish who created the account (SubjectLogonId → 4624) and whether it was immediately enabled, added to privileged groups (4728, 4732, 4756) or used to log on.

03Caveats

Recorded only when the "Audit User Account Management" audit subcategory is enabled. Retention depends on log size and overwrite settings.

05Sources

  1. Microsoft Learn — 4720(S) A user account was created checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.