// REFERENCE
4720 — User account created
Log: Security
High risk
A user account was created. Outside HR/IT onboarding flows it is a strong persistence signal: attackers create accounts to keep access. Watch for accounts created off-hours or by accounts that don't manage users.
Related tools
Work with this in:
Related
4722
4722 — User account enabled 4723
4723 — Password change attempt 4724
4724 — Password reset attempt 4725
4725 — User account disabled 4726
4726 — User account deleted 4728
4728 — Member added to a global security group
4722 — User account enabled 4723
4723 — Password change attempt 4724
4724 — Password reset attempt 4725
4725 — User account disabled 4726
4726 — User account deleted 4728
4728 — Member added to a global security group
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.