Event ID 4726A user account was deleted

What to check

Check who deleted it and alert on deletion of high-value, service or local accounts.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4726 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

1
2
3
4
5SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4726
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Related Accounts events

• Event ID 4720: A user account was created
• Event ID 4722: A user account was enabled
• Event ID 4723: An attempt was made to change an account's password
• Event ID 4724: An attempt was made to reset an account's password
• Event ID 4725: A user account was disabled
• Event ID 4738: A user account was changed
• Event ID 4740: A user account was locked out
• Event ID 4767: A user account was unlocked

Search all 123 event IDs →