Event ID 4720 records the creation of a new user account in the Security log on domain controllers, member servers and workstations. It can indicate legitimate onboarding or an attacker creating persistence. Review SAM Account Name, Primary Group ID, SID History and Allowed To Delegate To, and verify the account owner and approval trail.
Why Event ID 4720 is operationally important
Event ID 4720 is not just an inventory event, it is a control point for account creation. In normal operations it should line up with a documented joiner workflow, a service request, or an administrative action that has an owner. When it appears outside that expected path, it becomes an early indicator that someone may be creating a foothold rather than a legitimate user.
For security teams, the key question is whether the new account is consistent with the business process that should have produced it. The account name, group placement, delegation settings, and history fields help distinguish routine provisioning from a quietly planted persistence mechanism. A single creation event can matter even when no malicious logon has yet occurred, because account creation is often the first durable step in a compromise.
Because the event is generated on domain controllers, member servers, and workstations, it can expose local abuse as well as domain-wide abuse. That makes it useful for both central monitoring and host-level hunting, especially when the account is created in a time window that does not match approved change activity. For broader Windows event triage, see Windows Event Log Guide.
What to inspect in the account details
Event ID 4720 becomes more actionable when you read the account attributes instead of treating the log entry as a simple create event. The direct answer already points to the most useful fields: SAM Account Name, Primary Group ID, SID History, and Allowed To Delegate To. Together, those fields show whether the account looks like a normal employee identity, a privileged administrative identity, or a deliberately shaped access path.
SAM Account Name is useful for spotting naming patterns that do not fit the organisation’s standard. Primary Group ID can reveal privileged or unusual group association choices at creation time, while SID History can expose attempts to inherit access from an older identity. Allowed To Delegate To is especially important because delegation settings can turn a fresh account into a pivot point even before it has been widely used.
That inspection is strongest when paired with surrounding telemetry. Correlate the create event with logon activity, group membership changes, and any subsequent service or task creation so you can see whether the new account was introduced as part of a normal onboarding sequence or as part of a broader persistence chain. If your team uses centralised detection engineering, SIEM Guide is the natural companion for building and tuning that correlation.
How teams should treat 4720 in monitoring and response
Security teams should treat 4720 as a trigger for verification, not as evidence of compromise on its own. The event matters most when it cannot be matched to an approved request, a named owner, and a valid business reason. If those elements are missing, the account should be reviewed as a possible persistence or privilege-staging attempt, even if it has not yet been used interactively.
Monitoring should also consider what follows the account creation. A newly created account that immediately receives rights, is assigned delegation, or appears alongside remote administration activity deserves faster escalation than a harmless-looking helpdesk test account. That is why account creation telemetry is useful in conjunction with host telemetry and script activity, and why Sysmon Guide and PowerShell Security Guide can help teams tie user creation to the follow-on actions that often reveal intent.
For defenders, the practical response is to confirm the account owner, validate the approval trail, and check whether the new identity was used to expand access or blend into normal administrative traffic. That workflow is consistent with the event’s value as an audit signal, a hunting signal, and a containment signal all at once.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1136 — Create Account | Account creation is the core behavior behind Event ID 4720. |
| Recommendation — Map new-account events to T1136 and investigate for unauthorized persistence. | ||
| NIST CSF 2.0 | DE.AE-03 — Anomalies and events are analyzed to find cybersecurity incidents | 4720 is an anomalous event that needs correlation with expected provisioning. |
| Recommendation — Correlate account-creation anomalies with approved onboarding and response workflows. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Security log account-creation events depend on reliable audit generation. |
| AC-2 — Account Management | The event directly concerns provisioning and governance of user accounts. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | 4720 only becomes useful when teams review and correlate it promptly. | |
| Recommendation — Ensure account-creation audit records are generated and retained for investigation. Enforce account-creation approval, ownership, and periodic review. Review 4720 events with related logon and privilege activity for abuse signals. | ||
Practitioner Guidance
What to prioritise: Prioritise the approval trail and the first downstream use of the account. If the create event is legitimate, those two items usually explain the event quickly; if they are missing, the account should move into suspicious-creation triage immediately.
What to verify: Verify that the account name, group assignment, and delegation settings match the identity request. If any of those fields were set in a way that expands privilege beyond the stated business need, treat the event as more than routine onboarding.
Decision rule: If the account can authenticate to a sensitive environment or inherit access through history or delegation, investigate for abuse before assuming it is merely a provisioning artifact. The practical question is not whether the account exists, but whether its creation materially changed the access surface.
Practitioner takeaway: Event ID 4720 is important because it marks the point where a new identity enters the environment, and that is often where defenders can still separate legitimate administration from persistence, privilege shaping, or early-stage compromise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org