Event ID: 4741

A computer account was created

A computer account was created.

    Security ID:        %4
    Account Name:       %5
    Account Domain:     %6
    Logon ID:           %7

New Computer Account:
    Security ID:        %3
    Account Name:       %1
    Account Domain:     %2

    SAM Account Name:        %9
    Display Name:            %10
    User Principal Name:     %11
    Home Directory:          %12
    Home Drive:              %13
    Script Path:             %14
    Profile Path:            %15
    User Workstations:       %16
    Password Last Set:       %17
    Account Expires:         %18
    Primary Group ID:        %19
    AllowedToDelegateTo:     %20
    Old UAC Value:           %21
    New UAC Value:           %22
    User Account Control:    %23
    User Parameters:         %24
    SID History:             %25
    Logon Hours:             %26
    DNS Host Name:           %27
    Service Principal Names: %28

Additional Information:
    Privileges      %8

This event generates every time a new computer object is successfully created. There is no event logged when a computer object was attempted to be created but was unsuccessful.

Auditing:     Always

Keeps track of who created a computer account when.

Volume:     Low

Microsoft Documentation

Event ID - 4741

Name Field Insertion String OS Example
Account Name TargetUserName %1 Any ComputerName$
Account Domain TargetDomainName %2 Any DOMAIN
Security ID TargetSid %3 Any DOMAIN\ComputerName$
Security ID SubjectUserSid %4 Any DOMAIN\TheAdmin
Account Name SubjectUserName %5 Any TheAdmin
Account Domain SubjectDomainName %6 Any DOMAIN
Logon ID SubjectLogonId %7 Any 0xc88b2
Privileges PrivilegeList %8 Any View Codes
SAM Account Name SamAccountName %9 Any COMPUTERNAME$
Display Name DisplayName %10 Any -
User Principal Name UserPrincipalName %11 Any -
Home Directory HomeDirectory %12 Any -
Home Drive HomePath %13 Any -
Script Path ScriptPath %14 Any -
Profile Path ProfilePath %15 Any -
User Workstations UserWorkstations %16 Any -
Password Last Set PasswordLastSet %17 Any 8/12/2018 11:41:39 AM
Account Expires AccountExpires %18 Any <never>
Primary Group ID PrimaryGroupId %19 Any 515
AllowedToDelegateTo AllowedToDelegateTo %20 Any -
Old UAC Value OldUacValue %21 Any 0x0
New UAC Value NewUacValue %22 Any 0x80
User Account Control UserAccountControl %23 Any 'Workstation Trust Account' - Enabled
User Parameters UserParameters %24 Any -
SID History SidHistory %25 Any -
Logon Hours LogonHours %26 Any <value not set>
DNS Host Name DnsHostName %27 Any ComputerName.domain.local
Service Principal Names ServicePrincipalNames %28 Any HOST/ComputerName.domain.local RestrictedKrbHost/ComputerName.domain.local HOST/COMPUTERNAME RestrictedKrbHost/COMPUTERNAME

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Computer Account Management"

LEFT/RIGHT arrow keys for navigation

Back to List