Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How can I investigate the account creation and...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I investigate the account creation and addition to domain?
Hi Team,
I have tried EventCode 4720, 4722, 624 and few others from online search with a user name. But it shows nothing. Please Help. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
4720 is account creation for example, but I think your question needs more details.
Are you collecting windows events from the server? For example with sysmon?
Are the events in the actual windows event log on the host?
Please explain your setup. Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am getting Eventlogs from server which involves four AD's.
These events are generating on the host server. Unable to find the logs about this particular account creation and this person has added to one of a domain too. I have tried to do search through 4720 but it showed couple of hundred logs.
What I need to know is --- Time of account creation --- Who has created the person's account ---- who has added that person into a domain. Hope this will help you to understand the question.
Please assist. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A person's name who has created an account for another user and added into a domain admin group.
collecting windows logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What data your collecting from windows devices?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am getting Eventlogs from server which involves four AD's.
These events are generating on the host server. Unable to find the logs about this particular account creation and this person has added to one of a domain too. I have tried to do search through 4720 but it showed couple of hundred logs.
What I need to know is --- Time of account creation --- Who has created the person's account ---- who has added that person into a domain. Hope this will help you to understand the question.
Please assist. Thank you.
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Feel the Splunk Love: Real Stories from Real Customers
Data Management Digest – November 2025
