Windows EventInformation
Windows Event ID 4725 – Microsoft-Windows-Security-Auditing: User Account Disabled
Event ID 4725 fires when a user account is disabled in Active Directory or on a local Windows system, providing audit trail for account management activities.