Find out who created a user account using PowerShell:

Perform the following actions on the domain controller (DC):

1. Press Start, search for Windows PowerShell, right-click on it, and select Run as administrator.
2. Type the following script into the console: Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4720} | Select-Object -Property *
3. Press Enter.

4. This script will display the properties of Event ID 4720, which is logged when a user account is created. In the output, under Message → Subject, the Account Name, and security ID of the user that created the target user can be seen.

Note: If you are using a workstation, the following script should be run on PowerShell:

Get-EventLog -LogName Security -ComputerName <DC name>| Where-Object {$_.EventID -eq 4720} | Select-Object -Property *

where <DC name> is the name of the DC where the user was created.

The above method for viewing user creation event is laborious and time-consuming. A third-party AD auditing tool will be a boon to IT sysadmins who have to deal with thousands of devices and events logged on each device. ManageEngine's ADAudit Plus provides a centralized platform to monitor all the changes in your AD, including user management actions such as creation, deletion, and more.