Windows Event ID 4725: A user account was disabled
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Event ID 4725 records disabling of a user account.
Technical Metadata
| Event ID | 4725 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0040 Impact / T1531 Account Access Removal |
| Key fields to watch | Target Account, Subject, Target SID |
Trigger Scenarios
It is written when an administrator or identity workflow disables a local or domain user account.
Key Fields
Target Account
The disabled identity; privileged and service accounts have elevated operational impact.
Subject
The actor performing the change.
Target SID
The stable account identifier for correlating rename or deletion events.
Threat Hunting Queries
SecurityEvent
| where EventID == 4725
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4725
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4725- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4725
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4725
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
- T1531Account Access Removal
Detection Notes
T1531 Account Access Removal is actionable when one SubjectLogonId disables multiple privileged or operational TargetUserName values. Use a documented local threshold=1 for break-glass or Tier-0 accounts and an environment-tuned bulk threshold for ordinary accounts; correlate the subject to 4624 and check for nearby 4719 or 1102 defense changes.
Common False Positives
- Offboarding and automated lifecycle workflows legitimately disable accounts.
- Incident responders may disable compromised accounts as containment.
Related Events
Sample Log
Subject: CORP\admin.ops
Target Account: CORP\backup.admin
Target SID: S-1-5-21-REDACTEDFrequently Asked Questions
What does Windows Event ID 4725 mean?
Event ID 4725 records that a Windows user account was disabled and identifies the actor and target account.
Does one disabled account indicate an attack?
No. Offboarding and account containment are common; prioritize unexpected disabling of privileged, backup, service, or break-glass identities.
How should bulk account disabling be detected?
Aggregate unique TargetUserName values by SubjectLogonId using an environment-specific threshold, and correlate with audit-policy changes and log clearing.
Sources
- 4725: Microsoft Windows security auditing event reference
Microsoft · vendor
- Account Access Removal (T1531)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule