how to know who create user on server 2019

Question

Dear Microsoft technical support ;

How can i know which admin of my 3 admins on server 2019 create this special user

and also how can i know the date of creation this user

Best Regards

Thank You

Answer 1

You can enable auditing for this purpose.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-user-account-management

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi,

1, We can enable the audit policy through local group policy editor under: Computer configuration>Windows settings>Security settings>Local policies>Audit Policy>Audit account management. Enable this policy for success.

2, Refresh the policy on the server, you can run CMD as administrator and run command: gpupdate /force
3, When the users are created, event 4720 will be logged. The following information will be logged in the event:
The name of the account that requested the “create user account” operation.
The name of the user account that was created.
The time of the operation

If i misunderstand you, feel free to let me know.

Best Regards,

Answer 3

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--