How to Investigate an Unexpected Privileged Account Creation

A new administrator account may be a legitimate change, automation artifact, or sign of unauthorized access.

Checks to make

Preserve the account event and actor details, check approval and change records, review sign-ins and actions performed, and confirm with the system owner through a trusted channel. Disable or contain access according to response policy if legitimacy cannot be established.

When to get help

Incident response support can review identity events and containment options. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.