ZEKASTRA

SecurityAccount management

4722 · A user account was enabled

Generated each time a user or computer object is enabled. For computer accounts it appears only on domain controllers.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId

02How to use it

Check whether a dormant or disabled account was re-enabled shortly before it was used; correlate with 4720, 4738 and subsequent 4624 events for the same SID.

03Caveats

Recorded only when the "Audit User Account Management" audit subcategory is enabled. Retention depends on log size and overwrite settings.

05Sources

  1. Microsoft Learn — 4722(S) A user account was enabled checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.