SOC Event Lookup
Event ID 4720AccountMgmtP1

Windows Event ID 4720: A user account was created

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4720 records creation of a local or domain user account and is a high-value signal for unauthorized persistence and account abuse.

Technical Metadata

Technical metadata for Event ID 4720
Event ID4720
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1136.001 Create Account: Local Account; TA0003 Persistence / T1136.002 Create Account: Domain Account
Key fields to watchSubject, Target Account, Account Expires / Password Last Set, User Principal Name

Trigger Scenarios

The event is generated when a security principal creates a user account on the audited computer or in Active Directory, depending on where the account is created.

Key Fields

Subject

The account that performed the creation. Validate whether it is an approved administrator, automation identity, or a potentially compromised privileged account.

Target Account

The new account name, domain, and security identifier. Look for names that imitate built-in accounts or established administrators.

Account Expires / Password Last Set

Account properties provide initial context. Long-lived accounts with passwords set at creation can be more useful to investigate than short-lived provisioning accounts.

User Principal Name

For domain accounts, this identifies the UPN assigned to the new identity and helps correlate the account across directory and cloud telemetry.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Event ID 4720
SecurityEvent
| where EventID == 4720
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Microsoft Sentinel Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Event ID 4720
index=wineventlog source="WinEventLog:Security" EventCode=4720
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before implementing event-specific filtering or aggregation.
Cortex XQL: Retrieve Event ID 4720
dataset = microsoft_windows_raw
| filter edr_event_id = 4720
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The relevant Windows event channel is ingested through a Cortex XDR Windows event collection path. Inspect raw provider fields because parsed field names vary by collection path and event provider.
Query reference
Sigma rule: Windows Event ID 4720
title: Windows Event ID 4720
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1136.001Create Account: Local Account
  • T1136.002Create Account: Domain Account

Detection Notes

T1136.001 Local Account or T1136.002 Domain Account persistence becomes higher confidence when the new Target Account is followed by 4722 enablement, 4732/4728 group addition, or a 4624 Type 10 logon in a local correlation window=60 minutes. Account names mimicking built-ins and UserAccountControl settings that disable password expiration require comparison with the approved provisioning workflow rather than name-only alerting.

Common False Positives

  • HR-driven onboarding and automated identity provisioning regularly create valid accounts.
  • Application installers and lab environments may create local service identities.
  • Migration projects can create accounts in bursts that are unusual but authorized.

Related Events

Sample Log

Sanitized event sample
Subject: Account Name: CORP\admin.ops
Target Account: Account Name: svc_backup2
Target Domain: CORP
Target SID: S-1-5-21-REDACTED
User Principal Name: [email protected]

Frequently Asked Questions

What does Windows Event ID 4720 mean?

Event ID 4720 records creation of a Windows user account and identifies both the actor and the new account.

Where is Event ID 4720 generated?

For a domain account it is generated on a domain controller; for a local account it is generated on the computer where the account was created.

Does Event ID 4720 prove persistence?

No. Provisioning systems and administrators create legitimate accounts; investigate unexpected creators, naming patterns, account attributes, group additions, enablement, and subsequent logons.

Sources