Event ID 4725: A user account was disabled
Written when an account is disabled.
- Log
- Security
- Category
- Account management
Why it matters
- Mass disabling of accounts can be part of a destructive attack that locks staff out before ransomware runs.
What to check
Check who disabled it and whether many accounts were disabled in a short time.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1531 Account Access Removal