Windows Event ID 4725 – Microsoft-Windows-Security-Auditing: User Account Disabled

Start by examining the specific Event ID 4725 details to understand what happened and who initiated the action.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the right pane
4. Enter 4725 in the Event IDs field and click OK
5. Double-click on a 4725 event to view details
6. Review the Subject section to identify who disabled the account
7. Check the Target Account section to see which account was disabled
8. Note the timestamp and computer name for correlation with other events

The event details will show the Security ID, Account Name, and Account Domain for both the subject (who performed the action) and target (account that was disabled).

Use PowerShell to efficiently search and analyze Event ID 4725 occurrences across your environment.

1. Open PowerShell as Administrator
2. Query recent account disabling events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific date range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725; StartTime=$StartTime; EndTime=$EndTime}

4. Extract specific account information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725} | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data[1].'#text'
           TargetUserName = $Event.Event.EventData.Data[5].'#text'
           TargetDomain = $Event.Event.EventData.Data[6].'#text'
       }
   }

5. Export results to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725} | Select-Object TimeCreated, Id, Message | Export-Csv -Path "C:\Temp\DisabledAccounts.csv" -NoTypeInformation

Verify the current status of disabled accounts and correlate with the audit events.

1. Open Active Directory Users and Computers from Administrative Tools
2. Enable Advanced Features from the View menu
3. Navigate to the organizational unit containing the disabled account
4. Right-click the user account and select Properties
5. Check the Account tab to confirm the account is disabled
6. Review the Account Options section for additional restrictions
7. Use PowerShell to query disabled accounts:

   Get-ADUser -Filter {Enabled -eq $false} -Properties Name, SamAccountName, WhenChanged, LastLogonDate | Select-Object Name, SamAccountName, Enabled, WhenChanged, LastLogonDate

8. Cross-reference the WhenChanged timestamp with Event ID 4725 timestamps
9. Check for related events around the same timeframe:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=@(4724,4725,4726,4738)} -MaxEvents 100 | Where-Object {$_.Message -like "*username*"}

Set up comprehensive monitoring for account management events to catch future occurrences.

1. Open Group Policy Management Console on a domain controller
2. Navigate to Default Domain Controllers Policy or create a new GPO
3. Go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Expand Account Management and configure:
   • Audit User Account Management: Success and Failure
   • Audit Security Group Management: Success and Failure
5. Apply the policy and run gpupdate /force on domain controllers
6. Set up PowerShell monitoring script:

   # Create scheduled task to monitor account disabling
   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorAccountDisabling.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   Register-ScheduledTask -TaskName "MonitorAccountDisabling" -Action $Action -Trigger $Trigger -Principal $Principal

7. Create the monitoring script at C:\Scripts\MonitorAccountDisabling.ps1:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725; StartTime=(Get-Date).AddMinutes(-5)}
   if ($Events) {
       $Events | ForEach-Object {
           $EventXML = [xml]$_.ToXml()
           $TargetUser = $EventXML.Event.EventData.Data[5].'#text'
           Write-EventLog -LogName Application -Source "Account Monitor" -EventId 1001 -Message "Account disabled: $TargetUser"
       }
   }

Perform deep forensic analysis to understand the context and implications of account disabling events.

1. Collect comprehensive event data using advanced PowerShell queries:

   # Gather related security events for forensic analysis
   $StartDate = (Get-Date).AddDays(-30)
   $SecurityEvents = @(4624,4625,4648,4672,4720,4722,4724,4725,4726,4738,4740,4767)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$SecurityEvents; StartTime=$StartDate} | Export-Clixml -Path "C:\Forensics\SecurityEvents.xml"

2. Analyze logon patterns before account disabling:

   # Check last successful logons for disabled accounts
   $DisabledEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725}
   $DisabledEvents | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $TargetUser = $EventXML.Event.EventData.Data[5].'#text'
       $LastLogon = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object {$_.Message -like "*$TargetUser*"} | Select-Object -First 1
       Write-Output "User: $TargetUser, Last Logon: $($LastLogon.TimeCreated)"
   }

3. Check for privilege escalation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1)}

4. Review system event logs for related activities:

   Get-WinEvent -FilterHashtable @{LogName='System'; Level=2,3; StartTime=(Get-Date).AddHours(-2)}

5. Generate comprehensive forensic report:

   # Create detailed forensic timeline
   $Report = @()
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4725; StartTime=(Get-Date).AddDays(-7)}
   $Events | ForEach-Object {
       $EventXML = [xml]$_.ToXml()
       $Report += [PSCustomObject]@{
           Timestamp = $_.TimeCreated
           EventID = $_.Id
           Subject = $EventXML.Event.EventData.Data[1].'#text'
           TargetAccount = $EventXML.Event.EventData.Data[5].'#text'
           Computer = $_.MachineName
       }
   }
   $Report | Export-Csv -Path "C:\Forensics\AccountDisablingReport.csv" -NoTypeInformation