https://community.checkpoint.com/t5/Endpoint/Harmony-Endpoint-Event-ID-4720-About/m-p/127929#M4654 <P>Hello there;<BR />Can we block logs generated by windows account event ID 4720 for compliance endpoint? We can be on the short EDR path.</P><P>creating a user locally. Can we prevent this at the compliance endpoint?</P> Wed, 25 Aug 2021 07:18:59 GMT sertanulucan 2021-08-25T07:18:59Z https://community.checkpoint.com/t5/Endpoint/Harmony-Endpoint-Event-ID-4720-About/m-p/127929#M4654 <P>Hello there;<BR />Can we block logs generated by windows account event ID 4720 for compliance endpoint? We can be on the short EDR path.</P><P>creating a user locally. Can we prevent this at the compliance endpoint?</P> Wed, 25 Aug 2021 07:18:59 GMT https://community.checkpoint.com/t5/Endpoint/Harmony-Endpoint-Event-ID-4720-About/m-p/127929#M4654 sertanulucan 2021-08-25T07:18:59Z https://community.checkpoint.com/t5/Endpoint/Harmony-Endpoint-Event-ID-4720-About/m-p/128258#M4657 <P>Not sure what you mean by "We can be on the short EDR path."<BR />What version of the Endpoint client is in question?<BR />What is the management server version (or is it cloud-managed)?</P> Fri, 27 Aug 2021 19:03:18 GMT https://community.checkpoint.com/t5/Endpoint/Harmony-Endpoint-Event-ID-4720-About/m-p/128258#M4657 PhoneBoy 2021-08-27T19:03:18Z