At a SaaS company, Windows event 4720 shows that an account was created, and event 4732 shows that the same account was added to the local administrators group. What do these two events show together?
Select an answer to reveal the explanation.
Short Explanation
A new hire who is also handed your building master key is more than a new name on a list. Events 4720 and 4732 together mean a new account was created and added to the local administrators group. A failed logon, a cleared audit log, and a DNS zone transfer are different records.
Full Explanation
Read together, creation plus membership in the local administrators group is a new local administrator on that host. A new account was created and then added to the local Administrators group, so a new local admin is on that host, is the combined reading of 4720 and 4732. Only a failed logon, the pattern of event 4625, rather than account creation plus a group change, is a different event and is not what these two records say. A cleared security audit log, the action recorded when event 1102 is written on the host, means the audit log was cleared, not that an account was created. A DNS zone transfer from the company name server, unrelated to these two Windows events, is a name-service copy and does not describe local group membership. Exam caveat: 4732 is a security-enabled local group change on that host, so this pair is about the local Administrators group named in the scenario, and either event alone would be a weaker claim. Operational check: confirm both events name the same account and that the group on the 4732 event is Administrators, then look for a change ticket.