Write custom field on user creation on AD

Question

Hi,

I'm developing some scripts in order to have some visibility of some key issues within user creation.

So I have a powershell script that reads some information about the users created in a 7 day range and sends it over email for analysis. One detail I'm missing is about each new created user, who was it created by. I've searched a bit, and that's event 4720 registered on Security Event Log for each DC. The issue is that due to the amount of events being created, I only have about 3/4h of events on the security event log.

So to overcome this issue, what I considered was while creating the AD User, being able to use a custom field to write the creator user as well, so this way I would have all the information I need. Is this something possible?

Thanks

Answer 1

Hi,

So to overcome this issue, what I considered was while creating the AD User, being able to use a custom field to write the creator user as well, so this way ****I would have all the information I need. Is this something possible?

If the event collection is complicated for you, you can user description field to mention who created user account while its creation.

Please don't forget to mark helpful reply as answer

Answer 2

Hi,

Thanks for the reply.
But my goal is not a manual note on the description field. The goal is to automate it. Basically change AD behavior in order to write automatically the creator user into a custom field.
I need to know if this is possible and some guidance to reach it.

Thanks in advance.

Answer 3

Hi,

But my goal is not a manual note on the description field. The goal is to automate it. Basically change AD behavior in order to write automatically the creator user into a custom field.

No, it's not possible. There is a attribute to know when the user account was created but we can't know who create it. You should check event viewer.
However ,You can add this kind of information manually in description field as mentioned in may previous answer while the user creation process using powershell command for example.

Please don't forget to update helpful reply as answer

Answer 4

Hi @David Marques

There is a couple of option you could look at but they are not simple:

One possible option is to use the object owner, when an object is created the user that created the object is set as the owner in the security descriptor. However, if the user that created the object is a member of domain admins, then by default, domain admins will be marked as the owner. You can turn off this behaviour however it could cause you problems with permission management at a later date.

Another option is to implement a SIEM which would collect the logs and would be able to produce the report on object creation.

Another option is to creation a new properties page add-on for ADUC which could automatic add the user creating the object to an attribute. See this page for more details
https://learn.microsoft.com/en-us/windows/win32/ad/extending-the-user-interface-for-directory-objects

Gary.

Answer 5

Hi,

Thanks for the inputs. I know it's something that's not easy.
We have a SIEM, but it's not ours, it's provided as a service, so I would like to avoid that, but probably I'll have to explore that option.

Thanks