← cd ~/events
// events/4725 · Accounts
Event ID 4725A user account was disabled
A user or computer object was disabled. Computer account events are only logged on domain controllers.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Accounts |
What to check
Alert on high-value accounts and on accounts that should never be disabled, such as service accounts.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4725 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4725
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Accounts events
- Event ID 4720: A user account was created
- Event ID 4722: A user account was enabled
- Event ID 4723: An attempt was made to change an account's password
- Event ID 4724: An attempt was made to reset an account's password
- Event ID 4726: A user account was deleted
- Event ID 4738: A user account was changed
- Event ID 4740: A user account was locked out
- Event ID 4767: A user account was unlocked