Does Carbon Black log the creation or deletion of user accounts?

It is reported that to view the creation or deletion of user accounts in VMware Carbon Black, you will need to enable the following logs:

• User Account Management is the log that records all events related to user account management, including creation, deletion, and modification.


• On the other hand, the Windows Security log records all security-related events, including logins, logouts, and password changes.

To enable these logs, you may need to:

1. Navigate to Settings > Log Management > Log Sources in the VMware Carbon Black console.


2. Select the Windows log source.


3. Click the Edit button.


4. Select the User Account Management and Windows Security checkboxes in the Log Types section.


5. Click OK.

Once you have enabled these logs, viewing records of the created or deleted user accounts in the VMware Carbon Black would be possible.

Here are some additional things to keep in mind:

• The User Account Management log may not be available by default. You may need to contact your VMware Carbon Black administrator to enable it.


• The Windows Security log may be a large log, so you may need to use a filter to narrow down the results.

I hope this helps!