Event ID 4725 — Disabled, user account

A user account has been disabled.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Departure of an employee
• Containment measure
• Administrative deactivation

Verifications to be carried out

1. Identify target account
2. Check who did the action
3. Check that associated accesses are also processed

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.