When is Event ID 4726 logged?

What Event ID 4726 tells you

Event ID 4726 is the Windows Security log signal for a user account deletion. That makes it more than an administrative audit entry: it is a record of an identity lifecycle event that can remove a legitimate login path, break dependent services, or reflect an attacker cleaning up access after compromise. The key question is whether the deletion was expected, approved, and traceable to a known change.

Because the event records the target account and the actor, it supports both accountability and investigation. If the deleted account was privileged, used for automation, or tied to an application workflow, the operational impact can be immediate and wider than the account itself. In practice, the event is most useful when correlated with surrounding account-management events, authentication activity, and change records.

Windows Event Log Guide is the best starting point for understanding where 4726 sits among related account-management events and how it fits into Windows audit coverage.

Where and why 4726 appears

Event ID 4726 is generated in the Security log on systems that participate in account management, including domain controllers, member servers, and workstations. In other words, it is not limited to one tier of the environment. If a deletion occurs anywhere those audit events are enabled, the log should capture it at the point where the action is performed.

The most important practical implication is that the event reflects a destructive change, not just a state change. A deleted account can represent routine deprovisioning, emergency response, or malicious activity. That means the surrounding context matters: who initiated the action, what account was removed, whether the account had elevated privileges, and whether the timing aligns with a ticket, offboarding step, or incident.

For defenders, this event is especially valuable when paired with other Windows audit data. If you also review group membership changes, logons, service creation, and failed authentication around the same time, you can usually tell whether the deletion was part of normal administration or a broader attempt to reduce traceability.

Sysmon Guide helps when you want to correlate account deletion with broader endpoint activity, even though Sysmon does not replace native Security log auditing.

How to use 4726 in investigation and monitoring

Monitor 4726 as a high-signal account lifecycle event rather than a noisy routine audit entry. A single deletion can be benign, but repeated deletions, deletions outside maintenance windows, or deletions involving privileged, service, or break-glass accounts should prompt immediate review. The event is most useful when you can tie it to approved administration, decommissioning, or incident-response activity.

If you see 4726 and cannot quickly explain it, check three things first: whether the actor was authorized to remove the account, whether the deleted account had dependencies, and whether the deletion followed earlier sign-in, privilege, or group-change activity that suggests abuse. If the account supported automation or a business service, verify whether any service disruption followed, because the blast radius may be broader than the directory object itself.

PowerShell Security Guide is useful when the deletion may have been driven by scripted administration, since PowerShell activity often provides the surrounding evidence you need to confirm whether the change was legitimate.

Practitioner Guidance

What to verify: Treat each 4726 event as a change-control question first, not just a log-review item. Verify who deleted the account, whether the deletion was approved, and whether the account had any downstream dependencies such as scheduled tasks, service logons, delegated access, or application bindings.

What to measure: Track deletions of privileged, service, and dormant accounts separately from ordinary user offboarding. Those categories carry different operational and security significance, and they are the ones most likely to reveal abuse, overreach, or hidden system dependencies.

Common mistake: Teams often confirm that an account was deleted and stop there. The better question is whether the deletion was part of an expected lifecycle event or part of an attempt to remove access, disrupt operations, or obscure earlier activity.

Practitioner takeaway: 4726 is most valuable when you treat it as a traceable identity removal event with business impact potential, then verify authorization, dependencies, and surrounding activity before you accept it as routine.

Related resources from NHI Mgmt Group

• When is Event ID 4624 logged?
• When is Event ID 4648 logged?
• When is Event ID 4625 logged?
• When is Event ID 4663 logged?