> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigate-new-user.md).

# Investigate a Newly Created Domain User

## Objective

Investigate the creation of a new Active Directory user and identify who created the account, when it was created, and whether the activity was expected.

## Lab Systems

* `DC01`

## Generate Test Activity

In Active Directory Users and Computers, create a temporary domain user such as:

```
investigationuser01
```

Use a lab-only password and place the account in the normal lab users OU.

## Find the Evidence

On `DC01`, open the Security log and filter for:

```
4720
```

Event ID `4720` records the creation of a user account.

## Investigate the Event

Review the event and identify:

* newly created account
* account that performed the action
* domain
* time of creation
* relevant account attributes

Then review nearby events for additional activity involving the new account.

Useful questions include whether the account was enabled, changed, added to a group, or used to sign in shortly after creation.

## Investigation Questions

1. Who created the user?
2. What account was created?
3. When was it created?
4. Which OU contains the new account?
5. Was the account added to any security groups?
6. Was the creation expected?

## Example Finding

```
The domain account investigationuser01 was created by the lab administrator on DC01 during the planned exercise.
The account remained in the standard lab users OU and was not added to any privileged group.
The activity was expected and no additional action was required.
```

## Clean Up

Delete the temporary account after the exercise if it is no longer needed.

If the account is deleted, review Event ID `4726` as additional evidence.

## Security Relevance

New account creation should have a valid business or administrative reason. Unexpected account creation can represent unauthorized access, persistence, or poor account-management practice.

The important investigation task is to establish who created the account and what happened to it afterward.