Windows: how to intercept operations with users/groups?

Question

Does Windows have a mechanism for intercepting operations with users/groups such as create/delete, membership change ?

Google and stackoverflow give no answers yet. Reversing into netapi32!NetUserAdd etc gives nothing too.

Answer 1

Windows does not provide an interception mechanism that provides that feature, but you could hook the appropriate Win32 APIs using Detours or any other framework (or your own implementation). Once intercepted, you can filter and or forward the functions according to your needs.

Answer 2

Just some VBScript code for intercepting user creation. It's on you to rewrite it on C++/C#/whatever.

sub set_intercept()
    set wmi = GetObject("winmgmts:\\.\root\cimv2")
    set sink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
    wmi.ExecNotificationQueryAsync sink, "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Account'"
end sub 

sub SINK_OnObjectReady(obj, context)
    WScript.Echo "User was created"
end sub

set_intercept()