Skip to main content
AD Academy
Back to all events
4720Security (DC)AccountsWARNLast updated:

User account created

What it means

A new user was created. After a breach this is a classic persistence step.

First steps

  1. 1Check who created it (Subject) and whether an HR request exists.
  2. 2Look for nearby 4728/4732 — being added to admin groups.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.