I think that my lack of knowledge on the flow of events related to account creation on a windows server did not allow me to ask the correct question. After some research I believe that there is one event for new account created and another event for adding that account to the "Administrators" group.
Initially I thought that I could retrieve that information from the account creation Event logs - EventCode=4720.
At this point I am looking for newly created accounts that have Administrator privileges. No matter if it was created by someone with permission to or not - I am assuming it will only be created by accounts with permission to do so. I am no longer worried about the enabling of accounts.
I have found a way to do so.
Below is my comment to the previous answer,
"Since I could not find a way to retrieve the account type, I am currently just retrieving new accounts created and also retrieving EventCode=636(Security Enabled Local Group Member Added) and EventCode=4732 (A member was added to a security-enabled local group).
These events will tell me what groups the created users were added to.
Since I am writing c# code I can retrieve only the users that were added to the Administrators group.
Current search query,
host=* AND sourcetype=WinEventLog:Security AND (EventCode=4720 OR EventCode=4732 OR EventCode=624 OR EventCode=636 ) AND Account_Name=Administrator"
Thank you.
... View more