Windows Security Log · Event 4722

Event 4722: A user account was enabled

A disabled account was switched back on. Routine when someone returns from leave or a new account is finished being set up. Worth a question when the account has been dormant for a long time and nobody asked for it back.

Also written as Event ID 4722A user account was enabled4722 account enabled

How oftenUncommon
Vendor calls itAudit Success
LogSecurity
SourceMicrosoft-Windows-Security-Auditing

What it means for you

On a personal computer

An account on this PC was turned back on. If you did not do it, someone with administrator access did.

For an analyst

Pair it with 4725. An account disabled as part of offboarding and re-enabled months later, by someone outside your joiners-movers-leavers process, is worth chasing — a dormant account draws far less attention than a new one.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample

A user account was enabled.

Subject:
  Security ID:    CORP\jbrooks-adm
  Account Name:   jbrooks-adm
  Account Domain: CORP
  Logon ID:       0x3E9A11

Target Account:
  Security ID:    CORP\mchen
  Account Name:   mchen
  Account Domain: CORP

The fields that decide it

Everything else in the log line is context.

TargetUserName: The account that was enabled.
TargetSid: Its security identifier.
SubjectUserName: Who enabled it.
SubjectLogonId: The session that made the change. Join to the 4624 for the source address.

Ordinary reasons this happens

Most of the time it is one of these.

Someone returning from extended leave.
A new account being enabled once setup is finished.
A service account re-enabled after maintenance.
An account disabled in error and put back.
Identity management tooling reinstating access after a role change.

When it is not ordinary

Reviving a dormant account for quiet access.

What gives it awayA long-disabled account enabled outside change windows, particularly one belonging to a former employee.

ATT&CK T1098

Re-enabling an account that was disabled during an incident.

What gives it awayAn account enabled shortly after it was disabled by a responder.

ATT&CK T1098

Enabling a built-in account that should stay off.

What gives it awayThe local Administrator or Guest account being enabled, which almost never has a legitimate reason.

ATT&CK T1078.001

What to do next

Check when the account was disabled and why. A short gap is routine; a long one is not.
Confirm the person who enabled it does this as part of their job.
Match against a joiners-movers-leavers record or a ticket.
Check whether the account signed in afterwards, and from where.
For built-in accounts such as Guest or the local Administrator, treat this as a finding until explained.

Queries to run

kql Low enough volume in most environments to read every one.

SecurityEvent | where EventID == 4722 | project TimeGenerated, Computer, Account = TargetUserName, EnabledBy = SubjectUserName | order by TimeGenerated desc

kql Accounts revived after more than a month disabled — the dormant-account pattern.

let disabled = SecurityEvent | where EventID == 4725 | project OffTime = TimeGenerated, Account = TargetUserName;
let enabled = SecurityEvent | where EventID == 4722 | project OnTime = TimeGenerated, Account = TargetUserName, By = SubjectUserName;
disabled | join kind=inner enabled on Account | where OnTime > OffTime and OnTime - OffTime > 30d

Common questions

Why do I see Event 4722 and Event 4738 at the same time?

Because enabling an account is a change to it. Windows writes 4722 for the specific act of enabling and 4738 for the underlying attribute change, so the pair appearing together is normal rather than two separate events.

Should re-enabling an old account be treated as suspicious?

It depends on how long it was off and who did it. Someone back from leave is routine. An account belonging to a former employee, disabled for months and switched on outside a change window, is worth investigating — reviving a dormant account attracts far less attention than creating a new one.

Vendor documentation

Last reviewed 28 August 2026