NIST 800-53 REV 5 • ACCESS CONTROL
AC-2(4) — Automated Audit Actions
Automatically audit account creation, modification, enabling, disabling, and removal actions.
Practitioner Notes
Every time an account is created, modified, disabled, or removed, the system should automatically log that action. You need a paper trail that shows who did what to which account, and when.
Example 1: Enable Active Directory audit logging via GPO at Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Account Management. Turn on Audit User Account Management for Success and Failure. Forward these events (4720, 4722, 4725, 4726) to your SIEM.
Example 2: In M365, go to Microsoft Purview Compliance Portal → Audit and verify that Unified Audit Logging is turned on. Search for UserAccountCreated, UserAccountDeleted, and UserAccountUpdated events. Set up an alert policy to notify your security team whenever a new admin account is created.