Event ID 4726 — an account

A user account has been deleted.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Administrative cleaning
• End of life cycle
• Accidental

Verifications to be carried out

1. Identify account deleted
2. Check the author
3. Monitoring the impact on ACL and services

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.