> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-user-creation.md).

# Monitor User Account Creation

This lab creates a temporary Active Directory user and then finds the related security event on the domain controller.

## Objective

Generate and review Event ID `4720`, which records that a user account was created.

## Create a Temporary User

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Open the lab users organizational unit.
3. Right-click the empty area.
4. Select **New > User**.
5. Create a temporary account such as:

```
Username: tempuser01
Display name: Temporary Lab User
```

6. Set a lab-only password.
7. Complete the user creation.

## Find the Event

Open:

**Event Viewer > Windows Logs > Security**

Use **Filter Current Log** and enter:

```
4720
```

Open the newest matching event.

## What to Review

Look for fields that identify:

* the account that performed the action
* the newly created account
* the time of the event
* the domain involved
* the new account name

Windows event wording can vary slightly by operating system version, but the same basic information should be present.

## Ask the Security Questions

Try to answer:

1. Who created the account?
2. Which account was created?
3. When did it happen?
4. Was the change expected?

## Verification

The lab is successful when you can connect the manual creation of `tempuser01` with Event ID `4720` in the Security log.

Do not delete the temporary account yet. It will be reused in later exercises.

## Security Relevance

Unexpected user creation can indicate unauthorized administration, persistence, or misuse of privileged access. In a real environment, the event becomes more valuable when it is compared with approved change records and the privileges of the account that made the change.