ARO: New Administrative Account Detected

Admin accounts have greater access to an endpoint and can alter its configuration and affect the services running upon it.

Knowing that a new Admin account has been created will be alerted on to ensure that you are aware it has been created and to take action if it is unexpected.

This ARO is triggered by Windows Event Log entries that correspond to users being added to security-enabled group, either local or global. Field Effect combines multiple events from a single system, on a per user basis, into a single ARO.  

• https://social.technet.microsoft.com/wiki/contents/articles/17049.active-directory-event-id-4728-4729-when-user-added-or-removed-from-security-enabled-global-group.aspx
• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732