Windows Event ID 4725 — A user account was disabled

A user account was disabled. TargetUserName=disabled account.

Why event 4725 matters

Disabling security service accounts or IT admin accounts sabotages incident response. Also pre-ransomware: attackers disable backup accounts before deploying payloads.

How to detect it

Alert: security/IT/backup service accounts disabled. Alert: disabling by non-expected admin. Correlate with 4726 (deletion) — disable-then-delete is cleanup pattern.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 4725   // A user account was disabled
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4725
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A user account was disabled — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Related Account Management events