Direct answer
Correlate the new account, creator, device or directory context and time with an approved provisioning request, then review its intended privileges and lifecycle.
Identify the creation
Microsoft documents event 4720 when a user account is created. Account creation can be normal provisioning, but an unexplained account or creator requires follow-up. Determine whether the event applies to a local device or directory context before attributing ownership.
Reference: Microsoft: Security event 4720.
Record restricted evidence
Record the subject, new account identifier, device or domain context and event time. Avoid sharing personal account details broadly; confirm the event source and correlate later account changes. A display name alone can be misleading or reused.
Compare with provisioning
A local support account created during an approved laptop deployment can be expected. A newly created account on a sensitive machine without a request or owner should be escalated before changing it. Verify the request and whether a service or recovery function depends on the account.
Review resulting access
Check enabled status, group memberships and the account's owner with the identity and endpoint teams. Preserve evidence and use the incident process for unapproved creation. Avoid deleting an account before dependencies and evidence have been reviewed, and retest approved access after a correction.
Record unresolved ownership or unavailable provisioning evidence as an open question rather than assuming that the absence of a ticket proves abuse.
Assessment limits
The event does not prove subsequent use or all privileges. Visibility depends on the relevant account-management audit policy and collection.
Frequently asked questions
Does 4720 prove the account signed in?
No. It records account creation; review logon and later account events separately.
Does creation mean the account is an administrator?
No. Check group membership and effective privileges independently.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.