Event ID 4725AccountMgmtP2
Windows Event ID 4725: A user account was disabled
Event ID 4725 records disabling of a user account.
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-11
Trigger Scenarios
It is written when an administrator or identity workflow disables a local or domain user account.
Key Fields
Target Account
The disabled identity; privileged and service accounts have elevated operational impact.
Subject
The actor performing the change.
Target SID
The stable account identifier for correlating rename or deletion events.
Common False Positives
- Offboarding and automated lifecycle workflows legitimately disable accounts.
- Incident responders may disable compromised accounts as containment.
Related Events
MITRE ATT&CK Mapping
- T1531Account Access Removal
Detection Notes
T1531 destruction is indicated by more than five unique Target Accounts disabled by one Subject in a 15-minute window, particularly if the targets include backup or administrator accounts. Preserve the Subject Logon ID and correlate 4719/1102 defense changes. Use window=15 minutes for the high-fan-out disablement correlation.
SecurityEvent
| where EventID == 4725
| summarize Disabled=count() by Account, bin(TimeGenerated, 15m)
| where Disabled > 5index=wineventlog EventCode=4725 | stats count by SubjectUserName, TargetUserNameSubject: CORP\admin.ops
Target Account: CORP\backup.admin
Target SID: S-1-5-21-REDACTED