Hi Team,
I have tried EventCode 4720, 4722, 624 and few others from online search with a user name. But it shows nothing. Please Help. Thank you.
4720 is account creation for example, but I think your question needs more details.
Are you collecting windows events from the server? For example with sysmon?
Are the events in the actual windows event log on the host?
Please explain your setup. Thanks
I am getting Eventlogs from server which involves four AD's.
These events are generating on the host server. Unable to find the logs about this particular account creation and this person has added to one of a domain too. I have tried to do search through 4720 but it showed couple of hundred logs.
What I need to know is --- Time of account creation --- Who has created the person's account ---- who has added that person into a domain. Hope this will help you to understand the question.
Please assist. Thank you.
A person's name who has created an account for another user and added into a domain admin group.
collecting windows logs.
What data your collecting from windows devices?
I am getting Eventlogs from server which involves four AD's.
These events are generating on the host server. Unable to find the logs about this particular account creation and this person has added to one of a domain too. I have tried to do search through 4720 but it showed couple of hundred logs.
What I need to know is --- Time of account creation --- Who has created the person's account ---- who has added that person into a domain. Hope this will help you to understand the question.
Please assist. Thank you.