SOC Event Lookup
Event ID 4726AccountMgmtP2

Windows Event ID 4726: A user account was deleted

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4726 records that an Active Directory or local user account object was deleted, logging the Subject who performed the deletion and the Target Account that was removed.

Technical Metadata

Technical metadata for Event ID 4726
Event ID4726
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0040 Impact / T1531 Account Access Removal
Key fields to watchTarget Account\Account Name / Security ID, Subject\Account Name / Logon ID

Trigger Scenarios

Any deletion of a user account in Active Directory or on a local machine generates this event. Legitimate causes include off-boarding through HR-driven identity management, automated account lifecycle workflows, or privileged AD administration. Adversary use involves destroying accounts to prevent recovery, to disrupt operations, or to conceal earlier account-based activity.

Key Fields

Target Account\Account Name / Security ID

The identity of the account that was deleted. Deletion of an account whose name matches a domain admin, service account, or known operational identity is a direct T1531 Account Access Removal signal: those accounts protect resources or enable recovery, so removing them constitutes deliberate access disruption.

Subject\Account Name / Logon ID

The identity that performed the deletion. Correlate the Logon ID with the originating 4624 logon to identify the source workstation; a deletion made from an unusual source IP or by an account that does not normally manage directory objects warrants investigation.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4726
SecurityEvent
| where EventID == 4726
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4726
index=wineventlog source="WinEventLog:Security" EventCode=4726
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4726
dataset = microsoft_windows_raw
| filter edr_event_id = 4726
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4726
title: Windows Security Event ID 4726
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4726
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1531Account Access Removal

Detection Notes

T1531 Account Access Removal is supported when one SubjectLogonId deletes multiple TargetUserName values or deletes a privileged account outside the identity lifecycle workflow. Use a documented local threshold=1 for Tier-0 and break-glass accounts; join SubjectLogonId to 4624 because 4726 does not provide a source network address.

Common False Positives

  • Automated identity lifecycle systems routinely delete accounts for terminated employees.
  • Test accounts and temporary project accounts are deleted as part of normal cleanup workflows.
  • Migration projects may bulk-delete legacy accounts after migration is confirmed complete.

Related Events

Sample Log

Sanitized event sample
Subject:
  Security ID: CORP\svc-iam
  Account Name: svc-iam
  Account Domain: CORP
  Logon ID: 0x8B2140
Target Account:
  Security ID: CORP\da-backup
  Account Name: da-backup
  Account Domain: CORP
Additional Information:
  Privileges: -

Frequently Asked Questions

What does Windows Event ID 4726 mean?

Event ID 4726 records deletion of a Windows user account and identifies the actor and deleted account.

Where is 4726 generated?

A domain account deletion is logged on the authoritative domain controller; a local account deletion is logged on the affected computer.

Which account deletions deserve immediate review?

Unexpected deletion of privileged, service, backup, emergency, or recently active accounts should be reviewed regardless of volume.

Sources