Event ID 4720: a user account was created
Event 4720 means a new user account was created – a local account on this computer, or a domain account when you see it on a domain controller. Usually it is your IT adding a colleague. But creating an extra account, often added to Administrators right away, is also one of the first things an attacker does after getting in: a way back that survives a password change.
- What it is: a new user account. Who created it is in Subject, the new account in New Account.
- Where: local accounts on the computer itself; domain accounts on the domain controller that created them.
- Look at the events that follow: 4722 (enabled), 4724 (password set), 4732 / 4728 / 4756 (added to a group – Administrators!), 4726 (deleted).
- Suspicious: created at night, by an unexpected account or by
SYSTEM, an inconspicuous name (support, admin2, defaultuser), and added to Administrators within minutes.
1. Where to find it
Event Viewer › Windows Logs › Security, filter for 4720. It needs the audit subcategory User Account Management (Success), which Windows switches on by default. For domain accounts look on the domain controllers – each one logs only the accounts it created itself.
2. The fields that matter
- Subject › Account Name / Domain (
SubjectUserName,SubjectDomainName): who created the account. - New Account › Account Name / Domain (
TargetUserName,TargetDomainName) and Security ID (TargetSid): the new account. - Attributes: SAM account name, display name, user principal name, home directory, User Account Control flags (e.g. Password not required, Don't expire password – both unusual for a real user).
3. The events that belong to it
| Event | Meaning |
|---|---|
| 4720 | User account created |
| 4722 | User account enabled |
| 4724 | Someone reset the account's password |
| 4738 | User account changed |
| 4732 | Member added to a security-enabled local group – e.g. Administrators, Remote Desktop Users |
| 4728 / 4756 | Member added to a global / universal group – e.g. Domain Admins |
| 4726 | User account deleted |
A backdoor typically shows as 4720 → 4722 → 4732 (Administrators) within a few minutes, often followed by a logon (4624) of the new account by Remote Desktop.
4. PowerShell: new accounts and new administrators
As administrator; fields are read by name:
function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4726,4732,4728,4756; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
ForEach-Object { $f = Get-EventFields $_
[pscustomobject]@{ Time = $_.TimeCreated; Event = $_.Id; By = "$($f.SubjectDomainName)\$($f.SubjectUserName)"
Account = if ($_.Id -in 4720,4726) { $f.TargetUserName } elseif ($f.MemberName -and $f.MemberName -ne '-') { $f.MemberName } else { $f.MemberSid }
Group = if ($_.Id -in 4732,4728,4756) { $f.TargetUserName } else { '' } } } |
Sort-Object Time | Format-Table -AutoSizeAnd who is in the local Administrators group right now:
Get-LocalGroupMember -SID S-1-5-32-5445. Normal or attack?
- Normal: created during working hours by an IT account you know, a name that follows your naming scheme, added to ordinary groups, matching a ticket or a new colleague.
- Suspicious: created at night or at the weekend; by
SYSTEM, a service account or a user who never manages accounts; a generic name; Password not required or Don't expire password; added to Administrators or Remote Desktop Users right away; on a Server where nobody creates local accounts.
If you did not expect it: disable the account (Disable-LocalUser or in Active Directory), do not delete it yet (you lose evidence), check its logons (4624), and find out how the creator got in – often a guessed Remote Desktop password (4625).
6. Let Coinetic watch it for you
Coinetic works on the way in, before an attacker can create accounts:
- Password guessers and port scanners are banned automatically by a Windows Firewall rule.
- Remote Desktop invisible until you unlock it from your phone – the most common way in stays closed.
- A security check with plain explanations: open ports, risky settings and firewall rules nobody needs any more – each with a severity and a fix you can undo.
- Ask AI (Pro + AI): “Is someone guessing passwords on this Server?”
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Where do I see who created a domain account?
On the domain controller that created it, in its Security log (Event 4720, field Subject). Each domain controller logs only its own changes, so check all of them or collect the logs centrally.
Does Event 4720 show the new password?
No. Passwords are never written to the log. Event 4724 only records that a password was set or reset.
I see 4720 for an account like defaultuser0 after a Windows update - is that an attack?
Windows setup and some feature updates create temporary accounts such as defaultuser0 and remove them again. If it is created by SYSTEM during an update and disappears afterwards, it is normal.
What is the difference between 4732 and 4728?
4732 is a member added to a local (or domain local) group such as Administrators on a computer; 4728 is a member added to a global group such as Domain Admins.