Unit 5: Windows event logs · Lesson 4 of 6 · 16 min Pro

Account and group changes

Trace the creation of a backdoor account from 4720 to 4732 and confirm it was used.