Event ID 4725 — Disabled, user account

A user account has been disabled

TopicIT resources → About 1 min read

A user account has been disabled.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

Departure of an employee
Containment measure
Administrative deactivation

Verifications to be carried out

Identify target account
Check who did the action
Check that associated accesses are also processed

Commands

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725} -MaxEvents 20

Key takeaways

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.