Windows Event ID 4722: A user account was enabled
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Event ID 4722 records enabling of a user account.
Technical Metadata
| Event ID | 4722 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0003 Persistence / T1098 Account Manipulation |
| Key fields to watch | Target Account, Subject, Target SID |
Trigger Scenarios
Windows logs it when an administrator or workflow enables a local or domain account.
Key Fields
Target Account
The account enabled; dormant, disabled, and privileged accounts require context.
Subject
The actor who enabled it.
Target SID
A stable identity for correlating renamed accounts.
Threat Hunting Queries
SecurityEvent
| where EventID == 4722
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4722
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4722- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4722
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4722
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
- T1098Account Manipulation
Detection Notes
T1098 Account Manipulation is supported when a target account previously disabled in 4725 is re-enabled by 4722 and then used in a correlated 4624 Logon Type 10 session from an unexpected source. Use the environment's approved account-lifecycle timing rather than a universal threshold, and join SubjectLogonId to the enabling administrator's 4624 session.
Common False Positives
- Onboarding and identity workflows enable valid accounts.
- Helpdesk staff re-enable accounts after lockout or leave.
Related Events
Sample Log
Subject: CORP\admin.ops
Target Account: CORP\former.user
Target SID: S-1-5-21-REDACTEDFrequently Asked Questions
What does Windows Event ID 4722 mean?
Event ID 4722 records that a Windows user account was enabled and identifies the actor and target account.
Where is Event ID 4722 generated?
For a domain account it is generated on the authoritative domain controller; for a local account it is generated on the computer where the account was enabled.
Does enabling an account prove persistence?
No. Onboarding, leave return, and administrative recovery are common; investigate dormant, privileged, service, and recently disabled accounts against identity-management approvals.
Sources
- 4722: Microsoft Windows security auditing event reference
Microsoft · vendor
- Account Manipulation (T1098)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule