New user created with admin priviliges Expand / Collapse
Author
Message
Posted 9/7/2016 9:27:38 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 12/5/2017 10:07:22 AM
Posts: 1, Visits: 7
I am looking for events for the creation of a new user with admin priviliges.
SO far I found event ID 4720 (account created) and 4672.
WOuld this be correct?
Post #6263
Posted 9/26/2016 6:38:04 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
The event 4720 will only show a user created while 4672 indicates an administrative user logged on. You should be looked for users that are added to privileged AD security groups such as domain admins by looking for 4728, 4732, and 4756.
Post #6268
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:13am