Event ID: 4741

A computer account was created

A computer account was created.

Subject:
    Security ID:        %4
    Account Name:       %5
    Account Domain:     %6
    Logon ID:           %7

New Computer Account:
    Security ID:        %3
    Account Name:       %1
    Account Domain:     %2

Attributes:
    SAM Account Name:        %9
    Display Name:            %10
    User Principal Name:     %11
    Home Directory:          %12
    Home Drive:              %13
    Script Path:             %14
    Profile Path:            %15
    User Workstations:       %16
    Password Last Set:       %17
    Account Expires:         %18
    Primary Group ID:        %19
    AllowedToDelegateTo:     %20
    Old UAC Value:           %21
    New UAC Value:           %22
    User Account Control:    %23
    User Parameters:         %24
    SID History:             %25
    Logon Hours:             %26
    DNS Host Name:           %27
    Service Principal Names: %28

Additional Information:
    Privileges      %8
Microsoft Documentation

Event ID - 4741



This event generates every time a new computer object is created.



Name Field Insertion String OS Example
Account Name TargetUserName %1 Any ComputerName$
Account Domain TargetDomainName %2 Any DOMAIN
Security ID TargetSid %3 Any S-1-5-21-3457937927-2839227994-823803824-6116
Security ID SubjectUserSid %4 Any S-1-5-21-3457937927-2839227994-823803824-1104
Account Name SubjectUserName %5 Any UserName
Account Domain SubjectDomainName %6 Any DOMAIN
Logon ID SubjectLogonId %7 Any 0xc88b2
Privileges PrivilegeList %8 Any View Codes
SAM Account Name SamAccountName %9 Any COMPUTERNAME$
Display Name DisplayName %10 Any -
User Principal Name UserPrincipalName %11 Any -
Home Directory HomeDirectory %12 Any -
Home Drive HomePath %13 Any -
Script Path ScriptPath %14 Any -
Profile Path ProfilePath %15 Any -
User Workstations UserWorkstations %16 Any -
Password Last Set PasswordLastSet %17 Any 8/12/2018 11:41:39 AM
Account Expires AccountExpires %18 Any %%1794
Primary Group ID PrimaryGroupId %19 Any 515
AllowedToDelegateTo AllowedToDelegateTo %20 Any -
Old UAC Value OldUacValue %21 Any 0x0
New UAC Value NewUacValue %22 Any 0x80
User Account Control UserAccountControl %23 Any %%2087
User Parameters UserParameters %24 Any -
SID History SidHistory %25 Any -
Logon Hours LogonHours %26 Any %%1793
DNS Host Name DnsHostName %27 Any ComputerName.domain.local
Service Principal Names ServicePrincipalNames %28 Any HOST/ComputerName.domain.local RestrictedKrbHost/ComputerName.domain.local HOST/COMPUTERNAME RestrictedKrbHost/COMPUTERNAME


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Computer Account Management"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List