← cd ~/events
// events/4722 · Accounts
Event ID 4722A user account was enabled
A user or computer object was enabled. Computer account events are only logged on domain controllers.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Accounts |
What to check
Monitor every 4722 for local accounts on servers and admin workstations, since those rarely change.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4722 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4722
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Accounts events
- Event ID 4720: A user account was created
- Event ID 4723: An attempt was made to change an account's password
- Event ID 4724: An attempt was made to reset an account's password
- Event ID 4725: A user account was disabled
- Event ID 4726: A user account was deleted
- Event ID 4738: A user account was changed
- Event ID 4740: A user account was locked out
- Event ID 4767: A user account was unlocked