624: User Account Created
On this page
"Caller user" created "new account". This event will be accompanied by at least 2 subsequent event ID 642s and one 627.
Attributes: (Windows 2003)
User Account Created: New Account Name:harold New Domain:ELM New Account ID:ELM\harold Caller User Name:administrator Caller Domain:ELM Caller Logon ID:(0x0,0x158EB7) Privileges- Windows Server 2003 adds these fields Attributes: Sam Account Name:harold Display Name:harold User Principal Name:harold@elm.local Home Directory:- Home Drive:- Script Path:- Profile Path:- User Workstations:- Password Last Set: Account Expires: Primary Group ID:513 AllowedToDelegateTo:- Old UAC Value:0x0 New UAC Value:0x15 User Account Control: Account Disabled 'Password Not Required' - Enabled 'Normal Account' - Enabled User Parameters:- Sid History:- Logon Hours:
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection
Go To Event ID: Must be a 1-5 digit number No such event ID
Security Log Quick Reference Chart Download now!