ZEKASTRA

SecurityAccount management

4725 · A user account was disabled

Generated every time a user or computer object is disabled. For computer accounts it appears only on domain controllers.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId

02How to use it

Useful for showing when access was withdrawn, or when an attacker disabled accounts to disrupt response. Compare the time with later 4624/4625 for the same SID.

03Caveats

Recorded only when the "Audit User Account Management" audit subcategory is enabled. Retention depends on log size and overwrite settings.

05Sources

  1. Microsoft Learn — 4725(S) A user account was disabled checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.