Harmony Endpoint Event ID:4720 About

[sertanulucan]

Hello there;
Can we block logs generated by windows account event ID 4720 for compliance endpoint? We can be on the short EDR path.

creating a user locally. Can we prevent this at the compliance endpoint?

[PhoneBoy]

Not sure what you mean by "We can be on the short EDR path."
What version of the Endpoint client is in question?
What is the management server version (or is it cloud-managed)?