At a retailer, a register the real help desk does not use records Windows event 4720 for a new local account named helpdesk and event 4732 adding that account to the local Administrators group. What happened?
Select an answer to reveal the explanation.
Short Explanation
Somebody cut a new key and hung it on the manager hook in a store the managers do not staff. You have a new local account plus membership in the local Administrators group on that register. The trap is reading creation and a group add as a failed logon, a wiped log, or a Kerberos failure.
Full Explanation
Event 4720 records that a user account was created, and event 4732 records that a member was added to a security-enabled local group. Here the new account is named helpdesk and the 4732 record adds it to the local Administrators group, on a register the real help desk does not use. The event those two records support is this: An unexpected local administrator named helpdesk was created on a register the help desk does not use. A failed interactive logon on the register by an account that already existed on that register would be a failed sign-in, which is a different event from account creation and a group change. A cleared security audit log on the register in the moments after the helpdesk account showed up locally would be the audit log being cleared, and these records are the creation and the group add themselves. A Kerberos ticket failure between the register and a domain controller when the account appeared is not what 4720 or 4732 means; those two events are local account creation and local group membership. On the exam, 4732 means added to a security-enabled local group, and the group named in the record is what makes this account an administrator. In operations, confirm the group named in the 4732 record and whether that register is supposed to have any local administrators.