Tools · Windows security and Event Logs · 04 / 27
Windows account creation and change events: 4720, 4722, 4724, 4726, and 4738
Track who created, enabled, reset, changed, or deleted a user account, and alert on accounts created outside your provisioning process.
The account management family
4720 means a user account was created. 4722 means it was enabled. 4723 is a user changing their own password, and 4724 is an administrator resetting someone else’s. 4725 disables, 4726 deletes, and 4738 records changes to account attributes such as password-never-expires or the UPN. 4781 records a rename.
Each event names the Subject, who did it, and the Target, the account affected. On a domain these appear on the domain controller that processed the change; for local accounts, on the machine itself. The User Account Management audit subcategory must be enabled.
Why attackers create accounts
A new local administrator account is a simple persistence method that survives password resets of existing accounts. Attackers often choose names that blend in, such as support, admin2, or svc_backup. A 4720 followed within seconds by 4732 adding the account to Administrators is a pattern worth an alert on any machine.
Password resets (4724) on privileged accounts outside a help-desk ticket deserve review too.
Lab: create, elevate, and catch it
On a lab VM, create a local user, add it to Administrators, set password never expires, then delete it. Query the Security log for 4720, 4732, 4738, and 4726 in the last hour and line them up by time with subject and target.
Write the query as a function you can rerun. It is the core of a “new admin account” detection.
net user labtemp P@ssw0rd!Lab2026 /add
net localgroup Administrators labtemp /add
wmic useraccount where name='labtemp' set PasswordExpires=false
net user labtemp /delete
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4722,4724,4726,4732,4738; StartTime=(Get-Date).AddHours(-1)} |
Select-Object TimeCreated, Id, @{n='Summary';e={($_.Message -split "`n")[0]}} | Sort-Object TimeCreatedResponding to an unexpected account
Check who the subject was and from which logon session, then follow that session’s 4624 and 4688 events. Disable the account rather than deleting it so evidence remains. Search other machines for the same account name.
Compare new accounts against your provisioning system. Anything created outside it, especially by a non-admin workstation account, should be treated as suspicious until explained.
Diagram
The new-admin pattern
- 4720
A user account is created.
- 4722
It is enabled.
- 4732
It is added to the local Administrators group.
- 4738
Attributes changed, such as password never expires.
Check yourself
1. Which event ID records a user account being created?
2. Which event records an administrator resetting another user’s password?
3. Why disable rather than delete a suspicious new account?