How to Get a List of Active Directory User Accounts Created in Last 24 hours
Authored by: Support.com Tech Pro Team
1. Introduction
How to Get a List of Active Directory User Accounts Created in Last 24 hours
2. Step1: Configuring the audit policy
Type GPMC.MSC in the “Run†window to open the “Group Policy Management†console. You can also access it from the “Start Menu†or “Administrative Tools†in Control Panel.
Go to “Forest†→ “Domains†→ “www.domain.comâ€â†’“Domain Controllersâ€.
Edit any existingor newly create GPO at the domain controller level to access “Group Policy Management Editorâ€. You can create a new GPO and link it to the domain.
Our experts recommend never to edit the “Default Domain Policy†and “Default Domain Controller Policyâ€.
Select “Audit Policy†to view its policies in the right pane
Figure 1: “Group Policy Management Editorâ€
Right-click “Audit account managementâ€to access its properties.
Click to select “Define these policy settings†checkbox. Select both “Success†and “Failure†checkboxes.
Click “Apply†and “OK†to close “Audit account management Properties†window.
Close “Group Policy Management Editor†window.
In “Group Policy Management Consoleâ€, perform the following steps to apply this modified GPO to all Active Directory objects.
Select the modified GPO.
In the right pane’s “Security Filtering†section, click “Add†and type “Everyone†in the window that opens the screen.
Click “Check Names†to validate the value.
Click “OK†to add it.
Close “Group Policy Management Consoleâ€.
To update the applied policies, run the following command in “Command Promptâ€:gpupdate /force
3. Step 2: Tracking newly created accounts using Event Viewer
The event ID for user creation is 4720. Following is a screenshot of the same.
The steps to spot users created in the last 24-hours in the ‘Event Viewer†are:
Open “Windows Event Viewerâ€.
In the console tree, go to “Windows Logs†→ “Securityâ€.
Click “Filter Current Logâ€,on the “Action†menu in the right-pane. In case if a filter is already applied, click “Clear Filterâ€.
From “Logged†drop-down list, select the corresponding time period to filter the events based on when they occurred (here we select 24 hours from the list).
Type Event ID (4720 for user account creation) in “Event IDs†that you want the filter to display.
To apply the filter, click “OKâ€The screenshot given below displays a list of user accounts created in the last 24 hours: