Windows Security Log Event ID 4720 – A user account was created.
How can I find out when a user account was created?
Expand the domain and choose Users in the left-hand pane, you’ll see a list of AD users. Right-click on the account for which you want to find out the creation date, and select Properties. Go to the Object tab and you can view the date and time when the account has been created.
How do I enable event ID?
When a user account is enabled in Active Directory, event ID 4722 gets logged….Event ID 4722 – A user account was enabled.
| Event ID | 4722 |
|---|---|
| Category | Account management |
| Sub category | User account management |
| Description | A user account was enabled |
How do I find out who is enabled my ad account?
Open Event Viewer and search the security log for event ID 4722 (a user account was enabled).
- Run Netwrix Auditor → Navigate to “Search” → Click on “Advanced mode” if not selected → Set up the following filters:
- Click the “Search” button and review who enabled which user accounts in your Active Directory.
How do I find out who created an ad account?
AD User Accounts Creation Date
- Find the required user in the ADUC tree manually or by using the AD search function;
- Open the user’s properties and select the Object tab;
- The date the object was created in Active Directory is specified in the Created field.
How do I find the local user creation date?
You can check out the details of who created the local user account in the Event Properties. If the user account is a local user account, then the ‘Account Domain’ field will contain the device name on which it was created.
What event IDs are generated when a new user account is created?
When a new User Account is created on Active Directory with the option ” User must change password at next logon”, following Event IDs will be generated: A user account was created. A user account was enabled. An attempt was made to reset an account’s password.
What is the security ID and account name in Event Viewer?
Security ID [Type = SID]: SID of created user account. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. Account Name [Type = UnicodeString]: the name of the user account that was created.
What is event ID 4720 in Active Directory?
Event ID 4720 – A user account was created. When a user account is created in Active Directory, event ID 4720 is logged. This log data gives the following information:
What happens when a new user account is created on Active Directory?
When a new User Account is created on Active Directory with the option ” User must change password at next logon”, following Event IDs will be generated: A user account was created. A user account was enabled. An attempt was made to reset an account’s password. A user account was changed.
