Hello! I’m trying to find out who created a local account on a Windows server. The server has the Insight Agent installed. Is there a query I can use? Event logs on the server itself have been deleted.
If you have activated the “Open investigation” in the UEBA "Local Account created, you will receive an investigation with this details.
Aditionally, you can look for the “COMPUTER_ACCOUNT_CREATED” action in the Active Directory Admin Activity.
1 Like