Account creation monitoring

  • Thread starter Thread starter RSPD
  • Start date Start date
R

RSPD

I was wondering if the event viewer reports the creation of new account. If
so how can this be set up and what would be the event ID.

Thanks
-RSPD
 
You would have to enable auditing of Account Management Events and look for event ID
624 for user account creation. --- Steve
 
.... and here are some articles on how to enable Windows auditing to do so:

http://securityadmin.info/faq.htm#auditing

You do this on the local machine to monitor local accounts and I presume on
all domain controllers to monitor domain accounts, if you have a domain with
Windows servers on your network.
 
Back
Top