Event ID 4726 is a Windows Security audit event that records when a user account is deleted. It appears on domain controllers, member servers and workstations. Review the subject and target account details to identify who removed the account and whether the deletion was expected.
What Event ID 4726 Tells You
Event ID 4726 is a Windows Security audit record for a deleted user account. It is useful because account deletion is often a deliberate administrative action, but it can also signal an unexpected change to access, ownership, or incident response activity.
On a domain controller, member server, or workstation, the event helps answer three immediate questions: which account was removed, who performed the deletion, and whether the action matches an approved change. In practice, that makes it a control point for both routine administration and suspicious account removal.
What To Check In The Event Record
The most important fields are the subject account and the target account. The subject shows the security principal that performed the delete, while the target identifies the account that disappeared. Together, they help distinguish normal cleanup from unauthorized tampering.
Correlate the timestamp with help desk tickets, change windows, and other audit events around the same time. If the deleted account was privileged, service-related, or tied to a critical business process, the event deserves faster review because the operational impact can be immediate.
Why Account Deletion Matters For Security
Deleting an account changes who can authenticate and who can be held accountable. In an enterprise environment, that can be a clean offboarding step, but it can also be used to hide activity, disrupt operations, or remove an investigator’s visibility into a compromised account.
The event is especially important when it appears alongside other identity changes, such as password resets, group membership changes, or logon anomalies. A single delete event may be benign; a cluster of related changes can indicate privilege abuse or an attempt to erase evidence.
How To Use This Event In Monitoring And Review
Use Event ID 4726 as part of your broader Windows audit review, not as a standalone verdict. A deleted account should be checked against directory records, endpoint telemetry, and any surrounding administrative events so you can confirm whether the action was intentional and properly authorised.
When the deletion is unexpected, review whether the account had active sessions, scheduled tasks, service dependencies, or delegated permissions that may still remain in place. The most useful response is to reconstruct the sequence of account lifecycle changes, then determine whether additional containment or recovery steps are needed.
Risk and Threat Considerations
Unexpected account deletion can create both security and availability risk. It may remove an authorised user, but it can also be used by an attacker to disrupt operations, conceal prior access, or interfere with recovery and attribution.
Failure mechanism: A deleted account can break dependent access paths, reduce traceability, or mask malicious administration when the surrounding audit trail is incomplete.
Impact: Organisations can lose access continuity, miss evidence of compromise, or fail to detect that a privileged or business-critical account was removed without approval.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Event ID 4726 is a specific audit event that should be logged and reviewed. |
| AU-6 — Audit Record Review, Analysis, and Reporting | The event requires correlation and analysis to confirm whether deletion was authorised. | |
| AC-2 — Account Management | User-account deletion is an account lifecycle action governed by account management controls. | |
| Recommendation — Define account-deletion events as auditable security events and review them routinely. Correlate deletion events with change records and related activity to confirm legitimacy. Enforce approved account lifecycle workflows for creation, disabling, and deletion. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account deletion is a core account management activity that should be controlled and reviewed. |
| Recommendation — Track account removals against approved lifecycle processes and owner approval. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | The event is used through log review and correlation of security-relevant administrative actions. |
| Recommendation — Ensure administrative account changes are logged and reviewed with sufficient context. | ||
Practitioner Guidance
Why practitioners should care: Event ID 4726 is most valuable when it is tied to ownership and approval, because the event alone tells you that deletion occurred, not whether it was legitimate.
What to watch for: Treat deletions of privileged, service, or rarely used accounts as higher priority, especially when they do not line up with a change record or offboarding workflow.
Practitioner takeaway: The event is best used as a trigger for validation, compare it with directory state, change management evidence, and nearby audit events before deciding whether the deletion was expected.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org