fbpx
Back Arrow Back to All Integrations

Windows – Domain Administrator Account Creation

Windows – Domain Administrator Account Creation

Domain Administrator Account Creation SIEM Detection Test

Detecting when new Windows Domain Administrator accounts are created is important to audit and ensure that they have been created for business purposes. Often the addition of these accounts results in significant risk and exposure to an organization and access should be limited as much as possible.

 

Sign Up For Your Free Account Today

Get your free account with Blumira and secure your Microsoft 365 environment in minutes. No credit card required.

 

Free Trial

How to Test Your SIEM Detections for Domain Administrator Account Creation

Prerequisites: Be sure to configure the NxLog integrations for Windows on your Domain Controller before testing.

Step 1: Login to your Domain Controller logging to Blumira

Step 2: Go to “Users and Computers” in Active Directory

Step 3: Create a new user account

Step 4: Assign them to group “Domain Admins

Step 5: Once created and applied, a finding will generate in Blumira in the Responder Dashboard

Step 6: Be sure to delete or disable the new domain admin user after testing is completed.