Event ID 4741
A computer account was createdA computer account was created. Subject: Security ID: %4 Account Name: %5 Account Domain: %6 Logon ID: %7 New Computer Account: Security ID: %3 Account Name: %1 Account Domain: %2 Attributes: SAM Account Name: %9 Display Name: %10 User Principal Name: %11 Home Directory: %12 Home Drive: %13 Script Path: %14 Profile Path: %15 User Workstations: %16 Password Last Set: %17 Account Expires: %18 Primary Group ID: %19 AllowedToDelegateTo: %20 Old UAC Value: %21 New UAC Value: %22 User Account Control: %23 User Parameters: %24 SID History: %25 Logon Hours: %26 DNS Host Name: %27 Service Principal Names: %28 Additional Information: Privileges %8
This event generates every time a new computer object is successfully created. There is no event logged when a computer object was attempted to be created but was unsuccessful.
Auditing:
Always
Keeps track of who created a computer account when.
Volume:
Low
Microsoft Documentation
Name | Field | Insertion String | OS | Example | ||
---|---|---|---|---|---|---|
Account Name | TargetUserName | %1 | Any | ComputerName$ | ||
Account Domain | TargetDomainName | %2 | Any | DOMAIN | ||
Security ID | TargetSid | %3 | Any | DOMAIN\ComputerName$ | ||
Security ID | SubjectUserSid | %4 | Any | DOMAIN\TheAdmin | ||
Account Name | SubjectUserName | %5 | Any | TheAdmin | ||
Account Domain | SubjectDomainName | %6 | Any | DOMAIN | ||
Logon ID | SubjectLogonId | %7 | Any | 0xc88b2 | ||
Privileges | PrivilegeList | %8 | Any | View Codes | ||
SAM Account Name | SamAccountName | %9 | Any | COMPUTERNAME$ | ||
Display Name | DisplayName | %10 | Any | - | ||
User Principal Name | UserPrincipalName | %11 | Any | - | ||
Home Directory | HomeDirectory | %12 | Any | - | ||
Home Drive | HomePath | %13 | Any | - | ||
Script Path | ScriptPath | %14 | Any | - | ||
Profile Path | ProfilePath | %15 | Any | - | ||
User Workstations | UserWorkstations | %16 | Any | - | ||
Password Last Set | PasswordLastSet | %17 | Any | 8/12/2018 11:41:39 AM | ||
Account Expires | AccountExpires | %18 | Any | <never> | ||
Primary Group ID | PrimaryGroupId | %19 | Any | 515 | ||
AllowedToDelegateTo | AllowedToDelegateTo | %20 | Any | - | ||
Old UAC Value | OldUacValue | %21 | Any | 0x0 | ||
New UAC Value | NewUacValue | %22 | Any | 0x80 | ||
User Account Control | UserAccountControl | %23 | Any | 'Workstation Trust Account' - Enabled | ||
User Parameters | UserParameters | %24 | Any | - | ||
SID History | SidHistory | %25 | Any | - | ||
Logon Hours | LogonHours | %26 | Any | <value not set> | ||
DNS Host Name | DnsHostName | %27 | Any | ComputerName.domain.local | ||
Service Principal Names | ServicePrincipalNames | %28 | Any | HOST/ComputerName.domain.local RestrictedKrbHost/ComputerName.domain.local HOST/COMPUTERNAME RestrictedKrbHost/COMPUTERNAME |
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Computer Account Management"
LEFT/RIGHT arrow keys for navigation
Back to List