Event ID 4726 shows a user account was deleted, which can be normal offboarding or an attacker removing an account to hide access or disrupt recovery. Check who deleted the account, which domain it belonged to, and whether the deletion affects privileged or service accounts. Correlate with prior creation, enablement or password events for the same identity.
What Event ID 4726 usually means in an attack
Event ID 4726 means an account was deleted. In a normal environment that can be routine offboarding, but in an incident it can also indicate an attacker trying to erase an entry point, remove an account that was used for access, or interfere with recovery. The key question is whether the deletion fits an approved change or a suspicious cleanup pattern.
A deletion becomes much more interesting when it affects privileged users, service accounts, or accounts that were recently created, enabled, or modified. The practical value of the event is not the deletion alone, but the surrounding sequence: who had authority to do it, what other account lifecycle events happened nearby, and whether the same identity shows signs of staged abuse before the delete action.
How to tell benign offboarding from malicious account removal
Start by comparing the deletion to normal identity lifecycle behavior. Legitimate offboarding usually lines up with HR or change-management activity, occurs during business hours, and targets a user whose access no longer needs to exist. Malicious deletion often appears after suspicious logons, failed access attempts, privilege changes, or unusual administrative activity, and it may target an account that still has operational value to the business or to the attacker.
Pay attention to the domain the account belonged to, because deletion inside a sensitive administrative boundary has a different meaning from deletion of a low-risk local account. If the deleted account was privileged, part of a service chain, or associated with remote access or automation, treat the event as possible evidence of concealment or disruption rather than simple housekeeping.
What to correlate before you conclude it was hostile
Event 4726 should be read as part of a sequence, not as a standalone indicator. Correlate it with account creation, enablement, password resets, group membership changes, logon events, and recent administrative actions for the same identity. If the account was created and deleted in a short window, or enabled and removed after a burst of activity, that can point to a throwaway account, compromised account, or cleanup after unauthorized use.
Also check whether the deletion fits the same operator pattern as other suspicious changes. For example, a single actor who creates an account, grants access, uses it, and then deletes it may be trying to reduce forensic visibility. The same logic applies if deletion follows evidence of privilege escalation or access to sensitive systems. For a broader view of Windows event patterns, the Windows Event Log Guide is useful because it places 4726 alongside the surrounding account and logon events that usually make the story clear.
Risk and Threat Considerations
Account deletion can be an attacker-controlled way to hide access, break response workflows, or remove accounts that would otherwise reveal compromise. The risk increases when the deleted account has administrative power, is used by a service, or is tied to recovery and monitoring functions.
Failure mechanism: An adversary abuses legitimate account-management permissions to delete a user after use, or to remove an account that could later be investigated, locked, or used for recovery.
Impact: You can lose forensic continuity, disrupt dependent services, and delay containment if the deleted account was part of privileged access, automation, or incident-response coverage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1070.004 — File and Directory Discovery, indicator removal on host? | Account deletion can support defense evasion and cleanup after access. |
| Recommendation — Map deletion sequences to defense-evasion hunting and correlate with prior access activity. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalies and events are monitored to find incidents | 4726 is an event to monitor and correlate for suspicious account changes. |
| Recommendation — Correlate account-deletion events with surrounding identity activity and alert on suspicious patterns. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Event 4726 requires audit review and correlation to determine whether deletion was authorized. |
| Recommendation — Review deletion logs with adjacent account events and investigate unauthorized account removal. | ||
Practitioner Guidance
What to verify: Confirm the deleting principal, the change source, and the business reason for the deletion before you treat the event as benign. If the actor was not expected to perform account administration, or if the account was privileged, shared, or service-related, escalate immediately.
What to prioritise: Focus first on blast radius, not on the delete event itself. Check whether the deleted identity had active sessions, delegated rights, API access, scheduled tasks, mailbox access, or membership in sensitive groups that could still be abused after the account object is gone.
Practitioner takeaway: Event ID 4726 matters most when it removes an identity that was still operationally valuable, because the real signal is often the sequence around the deletion, not the deletion record alone.