Phone Get Quote
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

How to find who created an AD account with PowerShell and ADAudit Plus

The following is a comparison between the procedures to identify a user who created an account with Windows PowerShell and ADAudit Plus:

Windows PowerShell

Steps to obtain a user account report in Windows PowerShell

  • Define the domain from where the report should be generated.
  • Define the UPN and sAMaccount name for the newly created account.
  • Define the domain controller to retrieve the report from.
  • Execute the script.

Find the user who created an account


$dcs = Get-ADDomainController -Filter {Name -like "*"}

$upn = ''

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4720} |
Where-Object { $_.Message -match "user principal name:\s+$upn" } |
Select-Object -Expand Message |
Select-String '(?<=subject:\s+security id:\s+\S+\s+account name:\s+)\S+' |
Select-Object -Expand Matches |
Select-Object -Expand Value
$exportFilePath = "c:\scripts\lastLogon.csv"
$columns = "username,datetime"
Out-File -filepath $exportFilePath -force -InputObject $columns
Click to copy entire script

ADAudit Plus

Steps to obtain a user management report in ADAudit Plus

  • Login to ADAudit Plus web console using administrator credential. Select the 'Reports' tab and navigate to 'User Management' panel on the left.
  • Select the 'Recently Created User' report. In the advanced search filter, select 'SAM account' 'is' 'account_name'
  • Under the 'Caller Username' column, you can view who has created the account.
  • You can also choose to export this report in the desired format (CSV, HTML, XLS, PDF) using the export option.



Why ADAudit Plus is the better solution to get user activity reports

  • ADAudit Plus allows you to export reports in the desired format easily with a single click.
  • Automatically scans all DCs to obtain the required report.
  • Comes with advanced filter options that save you the trouble of creating complex LDAP queries.
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  • By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
  • Thanks!
  • Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Related Resources

ADAudit Plus Trusted By