Event ID 4720: user account created
What Event ID 4720 (user account created) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.
Event ID 4720 means a user account was created. On a domain controller that is a domain account; on any other machine it is a local one. New accounts are a classic persistence step, so every 4720 should match a ticket or an onboarding process.
The fields that matter
| Field | What it tells you |
|---|---|
| Subject | Who created the account. This is the field to check first. |
| New Account > Account Name | The new account's name. |
| Attributes | Initial settings such as the display name, UPN and whether a password is required. |
What is normal
HR onboarding, provisioning tools and the help desk creating accounts during working hours.
When Event ID 4720 is suspicious
- Created outside working hours or by an admin who doesn't normally create accounts.
- A new account added to an admin group (4728, 4732, 4756) within minutes.
- Names chosen to blend in:
admin,support,backup,svc_variants, or a name ending in$to look like a computer. - Local accounts created on servers or workstations, where nobody should be creating them by hand.
Common false positive: Identity provisioning tools create accounts in batches. Note the service account they run as and alert only on other creators.
Find Event ID 4720 with PowerShell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
ForEach-Object {
$d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
[pscustomobject]$d
} | Format-ListMicrosoft Sentinel (KQL)
SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4720
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated descRelated events
- Event ID 4722: User account enabled
- Event ID 4728: Member added to global security group
- Event ID 4732: Member added to local security group
- Event ID 4738: User account changed
FAQ
How do I tell if the account was created on a domain controller?
Look at the computer that logged the event. On a DC it is a domain account; anywhere else it is local to that machine.
What should I do with an unexplained 4720?
Disable the account first, then find out how the creator account was used: its logons (4624) and the processes it ran around that time.
Windows Event Triage reads a CSV, EVTX-to-JSON or XML export in your browser and flags brute force, new admins, suspicious services and log clearing.
IOC Triage, our free browser extension: right-click it for a verdict from 15 threat-intel sources, then copy a ready ticket note.