Windows Event ID 4720: A user account was created
Windows Security Event ID 4720 records creation of a local or domain user account and is a high-value signal for unauthorized persistence and account abuse.
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-10
Trigger Scenarios
The event is generated when a security principal creates a user account on the audited computer or in Active Directory, depending on where the account is created.
Key Fields
Subject
The account that performed the creation. Validate whether it is an approved administrator, automation identity, or a potentially compromised privileged account.
Target Account
The new account name, domain, and security identifier. Look for names that imitate built-in accounts or established administrators.
Account Expires / Password Last Set
Account properties provide initial context. Long-lived accounts with passwords set at creation can be more useful to investigate than short-lived provisioning accounts.
User Principal Name
For domain accounts, this identifies the UPN assigned to the new identity and helps correlate the account across directory and cloud telemetry.
Common False Positives
- HR-driven onboarding and automated identity provisioning regularly create valid accounts.
- Application installers and lab environments may create local service identities.
- Migration projects can create accounts in bursts that are unusual but authorized.
Related Events
MITRE ATT&CK Mapping
- T1136Create Account
- T1098Account Manipulation
Detection Notes
T1136 Create Account becomes high-confidence when a new Target Account is followed by 4722 enablement, 4732/4728 group addition, or a 4624 Type 10 logon within a short window. Account names mimicking built-ins and a password set with Password Never Expires are concrete persistence indicators.
SecurityEvent
| where EventID == 4720
| project TimeGenerated, Computer, SubjectAccount = Account, TargetAccount, TargetDomainName, TargetSid
| order by TimeGenerated descindex=wineventlog EventCode=4720
| table _time, host, SubjectUserName, TargetUserName, TargetDomainName, TargetSidSubject: Account Name: CORP\admin.ops
Target Account: Account Name: svc_backup2
Target Domain: CORP
Target SID: S-1-5-21-REDACTED
User Principal Name: svc_backup2@corp.example