Event ID 4720 is a Windows Security log event generated whenever a new user account is successfully created on a Windows system. You’ll typically find details like the account name, the account’s domain, who created it, and the time it was created.
In a healthy IT environment, you’ll see Event ID 4720 every now and then—new employees join the team, system administrators set up service accounts for certain applications, or you spin up temporary accounts for testing.
On the surface, nothing to worry about… right?
Just because something looks normal doesn’t mean it is. Attackers who’ve gained initial access to your environment will often use legitimate-looking steps to deepen their hold. Creating a new account blends right in with the usual noise of business operations, but it can give them ongoing access and a launching pad for further compromise.
Here’s why you should pay attention:
Before you sound the alarm, first consider the broader context of the event:
Being proactive is key to preventing new, unauthorized accounts from slipping through the cracks.
Follow these steps to stay safe:
Finding meaningful signals among the countless events in your environment isn’t always straightforward. Event ID 4720 might look harmless, but watching out for when and why new accounts appear is vital for keeping your network secure.
Huntress managed security solutions continuously monitor your systems, giving context and clarity around events like user account creation. With Huntress Managed SIEM and Managed EDR, you don’t have to worry about missing subtle indicators of compromise or spending hours deciphering logs. We give you only what’s important, guide you toward effective remediation, and help you make sure that no unauthorized account slips through the cracks.
Ready to strengthen your defenses and boost your overall security posture? Schedule a free Huntress demo and see how easy it can be to keep your organization secure from even the sneakiest threats.
Secure endpoints, email, and employees with the power of our 24/7 SOC. Try Huntress for free and deploy in minutes to start fighting threats.
Start Your Free Trial