Log Dejargonizer

Windows Security Log · Event 4725

Event 4725: A user account was disabled

An account was switched off without being deleted. It is the correct way to remove access — the account keeps its identifier, so what it owned and what it did remain traceable. Most are ordinary offboarding.

Also written as Event ID 4725A user account was disabled4725 account disabled

What it means for you

On a personal computer

An account on this PC was turned off. It still exists and its files are intact, but nobody can sign in with it.

For an analyst

Preferred over deletion, because the SID survives and permissions and past activity stay attributable. Watch for service accounts being disabled — that usually breaks something, and an unexplained one can be disruption rather than housekeeping.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
A user account was disabled.

Subject:
  Security ID:    CORP\jbrooks-adm
  Account Name:   jbrooks-adm
  Account Domain: CORP
  Logon ID:       0x3E9A11

Target Account:
  Security ID:    CORP\mchen
  Account Name:   mchen
  Account Domain: CORP

The fields that decide it

Everything else in the log line is context.

TargetUserName
The account that was disabled.
TargetSid
Its security identifier, which is retained.
SubjectUserName
Who disabled it.
SubjectLogonId
The session that made the change.

Ordinary reasons this happens

Most of the time it is one of these.

  • Someone leaving the organisation.
  • An account disabled during extended leave.
  • Decommissioning a service account after retiring an application.
  • Security responding to a suspected compromise by disabling the account deliberately.
  • Identity tooling disabling accounts that have been inactive past a policy threshold.

When it is not ordinary

Disrupting an organisation by cutting off access.

What gives it awaySeveral accounts disabled in a short window with no offboarding records, particularly administrators.

ATT&CK T1531

Disabling an account to hide activity attributed to it.

What gives it awayAn account disabled shortly after unusual activity from it, by someone other than the security team.

ATT&CK T1098

Removing a competing administrator during an intrusion.

What gives it awayAn administrative account disabled by another administrator with no change record.

ATT&CK T1531

What to do next

  1. Check whether an offboarding or change record exists.
  2. Confirm the person who disabled it does this as part of their job.
  3. For service accounts, find out what stopped working — a legitimate decommission accounts for that first.
  4. Count how many accounts were disabled in the same window.
  5. If the account had privileged access, review what it did in the days before.

Queries to run

kql 
SecurityEvent | where EventID == 4725 | project TimeGenerated, Computer, Account = TargetUserName, DisabledBy = SubjectUserName | order by TimeGenerated desc
kql Several accounts disabled at once, which no normal leaver process produces. 
SecurityEvent | where EventID == 4725 | summarize disabled = count() by SubjectUserName, bin(TimeGenerated, 30m) | where disabled > 3

Common questions

What is the difference between disabling and deleting an account?

Disabling stops sign-in but keeps the account and its security identifier, so file ownership, group membership, and past activity stay attributable. Deleting destroys the identifier permanently, and recreating the same name produces a different one that inherits nothing. Disable unless you are certain.

Does disabling an account end its current sessions?

Not immediately. An account already signed in can keep working until its session ends or its Kerberos tickets expire, which can be hours. If you are disabling an account during an incident, sign the sessions out and reset the password as well.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026