Removing a backdoor account after finishing with it.
What gives it awayA deletion of an account that was created recently, particularly outside change windows and by the same session that created it.
ATT&CK T1070Windows Security Log · Event 4726
Event 4726: A user account was deleted
A user account was removed. Most are ordinary offboarding. The ones that matter are deletions nobody requested, and deletions of accounts that were created only hours earlier — which is what cleaning up after an intrusion looks like.
Also written as 4726Event ID 4726A user account was deleted
- How oftenUncommon
- Vendor calls itAudit Success
- LogSecurity
- SourceMicrosoft-Windows-Security-Auditing
What it means for you
On a personal computer
An account was removed from this PC. If you did not do it, someone with administrator access did — which is worth understanding regardless of whose account it was.
For an analyst
Correlate against 4720. An account created and deleted inside the same day, especially outside change windows, is a strong indicator of an attacker covering their tracks. Deletions are also destructive in Active Directory: the SID is gone and recreating the name does not restore access.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
A user account was deleted.
Subject:
Security ID: CORP\jbrooks-adm
Account Name: jbrooks-adm
Account Domain: CORP
Logon ID: 0x3E9A11
Target Account:
Security ID: CORP\svc-update
Account Name: svc-update
Account Domain: CORP
Additional Information:
Privileges: -The fields that decide it
Everything else in the log line is context.
- TargetUserName
- The account that was deleted.
- TargetSid
- Its security identifier. Worth recording, because a recreated account with the same name gets a different SID and inherits none of the old permissions.
- SubjectUserName
- Who deleted it.
- SubjectLogonId
- The session that performed the deletion.
Ordinary reasons this happens
Most of the time it is one of these.
- Normal offboarding when someone leaves.
- Cleanup of temporary or contractor accounts after a project ends.
- Removal of local accounts left over from building a machine.
- Identity management tooling removing accounts as part of an automated lifecycle.
- An administrator undoing an account created by mistake.
When it is not ordinary
Destructive action against an organisation.
What gives it awaySeveral accounts deleted in a short window with no matching offboarding records.
ATT&CK T1531Removing evidence of account manipulation.
What gives it awayA deletion shortly after the account was used for privileged access.
ATT&CK T1070What to do next
- Check whether the account was created recently. A short-lived account is the pattern worth chasing.
- Match the deletion against your offboarding records.
- Read SubjectUserName and confirm that person performs offboarding.
- Count deletions in the same window — several at once with no leaver process is a serious finding.
- Preserve the SID from the event. It is the only way to identify what the account previously had access to.
Queries to run
let created = SecurityEvent | where EventID == 4720 | project CreateTime = TimeGenerated, Account = TargetUserName;
let deleted = SecurityEvent | where EventID == 4726 | project DeleteTime = TimeGenerated, Account = TargetUserName, DeletedBy = SubjectUserName;
created | join kind=inner deleted on Account | where DeleteTime - CreateTime < 24h | project Account, CreateTime, DeleteTime, DeletedBySecurityEvent | where EventID == 4726 | summarize deletions = count() by SubjectUserName, bin(TimeGenerated, 1h) | where deletions > 3Common questions
Can a deleted Windows account be recovered?
In Active Directory, only if the Recycle Bin feature is enabled, and even then within the deleted-object lifetime. For local accounts there is no recovery. Recreating an account with the same name produces a different SID, so it inherits none of the previous permissions or file ownership.
Why should accounts be disabled instead of deleted?
Because the SID is what actually holds permissions and file ownership, and deleting the account destroys the link between them. Disabling stops access immediately while keeping the ability to audit what the account had, restore it, or attribute past activity to it.
Read next
- Usually comes before Event 4720: A user account was created The creation of the account. Create and delete inside a day is the pattern to hunt.
- The equivalent of Event 4725: A user account was disabled Disabling an account, which is what should normally happen instead of deletion.
- Usually comes before Event 4732: A member was added to a local group Group membership the account held before it was removed.
- Related Event 1102: The audit log was cleared Clearing the audit log — another form of cleaning up after an intrusion.
Mentioned by
Vendor documentation
Last reviewed 28 August 2026