detection-rules
Loading

Audit User Account Management

Some detection rules require monitoring user account management activities to detect unauthorized account creations, modifications, or deletions. Enabling this setting ensures visibility into critical account changes, helping maintain security and compliance by tracking administrative actions related to user accounts.

To enable Audit User Account Management across a group of servers using Active Directory Group Policies, administrators must enable the Audit User Account Management policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:

Computer Configuration >
Policies >
Windows Settings >
Security Settings >
Advanced Audit Policies Configuration >
Audit Policies >
Account Management >
Audit User Account Management (Success,Failure)

To enable this policy on a local machine, run the following command in an elevated command prompt:

auditpol.exe /set /subcategory:"User Account Management" /success:enable /failure:enable

When this audit policy is enabled, the following event IDs may be generated:

  • 4720: A user account was created.
  • 4722: A user account was enabled.
  • 4723: An attempt was made to change an account's password.
  • 4724: An attempt was made to reset an account's password.
  • 4725: A user account was disabled.
  • 4726: A user account was deleted.
  • 4738: A user account was changed.
  • 4740: A user account was locked out.
  • 4765: SID History was added to an account.
  • 4766: An attempt to add SID History to an account failed.
  • 4767: A user account was unlocked.
  • 4780: The ACL was set on accounts which are members of administrators groups.
  • 4781: The name of an account was changed.
  • 4794: An attempt was made to set the Directory Services Restore Mode administrator password.
  • 4798: A user's local group membership was enumerated.
  • 5376: Credential Manager credentials were backed up.
  • 5377: Credential Manager credentials were restored from a backup.

Use the following GitHub search to identify rules that use the events listed:

Elastic Detection Rules Github Repo Search