Event ID 4726: A user account was deleted
Written when an account is deleted.
- Log
- Security
- Category
- Account management
Why it matters
- Attackers sometimes delete accounts they created, to cover their tracks, or delete admins' accounts to disrupt a response.
What to check
Check who deleted it, and look for a matching 4720 if the account was recently created.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1531 Account Access Removal