We are running some automated reports that give us information on accounts created in the last 24 hours.
index=wineventlog EventCode=4720 OR "A user account was created" | table _time Computer_Name Account_Domain Account_Name Display_Name | sort -_time
What I can't seem to find is a Windows event ID that includes a "creator" of the account. Is this something someone has found? or just is not possible? It's nice to get a report on what new accounts were created, but it would be nice to see WHO created the accounts.
Thanks in advance for any information!
... View more