Windows Event ID 4720: A user account was created
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4720 records creation of a local or domain user account and is a high-value signal for unauthorized persistence and account abuse.
Technical Metadata
| Event ID | 4720 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0003 Persistence / T1136.001 Create Account: Local Account; TA0003 Persistence / T1136.002 Create Account: Domain Account |
| Key fields to watch | Subject, Target Account, Account Expires / Password Last Set, User Principal Name |
Trigger Scenarios
The event is generated when a security principal creates a user account on the audited computer or in Active Directory, depending on where the account is created.
Key Fields
Subject
The account that performed the creation. Validate whether it is an approved administrator, automation identity, or a potentially compromised privileged account.
Target Account
The new account name, domain, and security identifier. Look for names that imitate built-in accounts or established administrators.
Account Expires / Password Last Set
Account properties provide initial context. Long-lived accounts with passwords set at creation can be more useful to investigate than short-lived provisioning accounts.
User Principal Name
For domain accounts, this identifies the UPN assigned to the new identity and helps correlate the account across directory and cloud telemetry.
Threat Hunting Queries
SecurityEvent
| where EventID == 4720
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4720
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4720- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
title: Windows Event ID 4720
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4720
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
- T1136.001Create Account: Local Account
- T1136.002Create Account: Domain Account
Detection Notes
T1136.001 Local Account or T1136.002 Domain Account persistence becomes higher confidence when the new Target Account is followed by 4722 enablement, 4732/4728 group addition, or a 4624 Type 10 logon in a local correlation window=60 minutes. Account names mimicking built-ins and UserAccountControl settings that disable password expiration require comparison with the approved provisioning workflow rather than name-only alerting.
Common False Positives
- HR-driven onboarding and automated identity provisioning regularly create valid accounts.
- Application installers and lab environments may create local service identities.
- Migration projects can create accounts in bursts that are unusual but authorized.
Related Events
Sample Log
Subject: Account Name: CORP\admin.ops
Target Account: Account Name: svc_backup2
Target Domain: CORP
Target SID: S-1-5-21-REDACTED
User Principal Name: [email protected]Frequently Asked Questions
What does Windows Event ID 4720 mean?
Event ID 4720 records creation of a Windows user account and identifies both the actor and the new account.
Where is Event ID 4720 generated?
For a domain account it is generated on a domain controller; for a local account it is generated on the computer where the account was created.
Does Event ID 4720 prove persistence?
No. Provisioning systems and administrators create legitimate accounts; investigate unexpected creators, naming patterns, account attributes, group additions, enablement, and subsequent logons.
Sources
- 4720: Microsoft Windows security auditing event reference
Microsoft · vendor
- Create Account: Local Account (T1136.001)
MITRE ATT&CK · attack
- Create Account: Domain Account (T1136.002)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule