I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]".

So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. However, I want to configure the audit to trigger an event only when very specific accounts are touched with the above command. If possible, the only event that I'm interested in is EventID 4661 SAM_USER.

For example, if a user uses net user /domain Administrator, I would like a event to be triggered, but not for net user /domain JohnDoe.

I could just audit everyone like I am doing right now, but there are just too many logs being created.

I tried following the instructions here: https://support.microsoft.com/en-us/help/841001/event-ids-560-and-562-appear-many-times-in-the-security-event-log

But it appears that these methods are for older servers.

I want to apply the auditing on specific users that will trigger the event. Not just when anyone is touched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.