ZEKASTRA

SecurityAccount management

4726 · A user account was deleted

Generated every time a user object is deleted, on domain controllers, member servers and workstations.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId
  • PrivilegeList

02How to use it

TargetSid identifies the deleted account reliably because SIDs are not reused; use it to find the account's earlier activity in other logs and artifacts.

03Caveats

Recorded only when the "Audit User Account Management" audit subcategory is enabled. Retention depends on log size and overwrite settings.

05Sources

  1. Microsoft Learn — 4726(S) A user account was deleted checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.