How to search Windows event logs for the "creator" of a new Active Directory account?

[apantoja]

We are running some automated reports that give us information on accounts created in the last 24 hours.

index=wineventlog EventCode=4720 OR "A user account was created" | table _time Computer_Name Account_Domain Account_Name Display_Name | sort -_time

What I can't seem to find is a Windows event ID that includes a "creator" of the account. Is this something someone has found? or just is not possible? It's nice to get a report on what new accounts were created, but it would be nice to see WHO created the accounts.

Thanks in advance for any information!

[dshpritz]

I know this is late, but it could help others:

If you have the Splunk Add-on for Windows installed, you will get two fields when looking at 4720 events, the user and the src_user. In the context of this event, the src_user is the user creating the account and the user is the user being created.

Note that per the Common Information Model, this isn't correct, and you would expect the user to be the user creating the action and the user being created should be in a field named object. So, in this case, the TA is incorrect.

HTH,

Dave