Event ID 4722 — Activation of a user account

A disabled user account has been reactivated.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Return of a collaborator
• Reactivation of a technical account
• Action not authorized

Verifications to be carried out

1. Identify target account
2. Check who did the action
3. Monitoring current groups and rights

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4722} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.