audit any new user account in AD

Posted on 2012-08-23
Last Modified: 2012-10-03
I'd like to audit any new user creations. If this alert could be saved in the event viewer as a saved filter that'd be great. I need to monitor this very closely.

Please advice.
Question by:UDSquare
    LVL 9

    Accepted Solution

    This will tell you how to do anything with Active Directory Auditing system:
    LVL 2

    Expert Comment

    We have set-up email alerts for some other events but including adding/creating new users (event 4720), I can help you with setting this up if you like, however if you just filter your security event viewer (on domain controller) to see event ID 4720. This will show you black on white when new user is created and by whom.

    Hope this helps
    LVL 6

    Expert Comment

    hi see below for windows 2003

    User Account Created - security 624
    User Account Enabled - security 626
    User Account Locked Out - security 644 or security 4740
    LVL 6

    Expert Comment

    you can download free SIEM tools which will let you add say 3-4 servers.

    Add your Dc in, then create a 'new user' thread so each time a new user is created for example its written to the thread.  You can then also specify if it happens alert me via email........

    Author Comment

    Thanks. We will check and update you the status.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
    by Nathan Brom/Bromy2004 Introduction There are numerous websites out there for any different type of program you can imagine.  Of those, you'll need to decide which ones are legitimate and aren't trying to steal your money or infect your comput…
    Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now