Windows Event ID 4726 – Microsoft-Windows-Security-Auditing: User Account Deleted

Start by examining the complete event details to understand the deletion context:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4726 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4726 in the Event IDs field and click OK
5. Double-click on a 4726 event to view detailed information including:
   • Subject: Who deleted the account (Account Name, Account Domain, Logon ID)
   • Target Account: Which account was deleted (Account Name, Account Domain, Security ID)
   • Additional Information: Privileges used for the operation
6. Note the timestamp and correlate with any change management processes or administrative activities

Use PowerShell to extract and analyze account deletion events programmatically:

1. Open PowerShell as Administrator
2. Query recent account deletion events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='DeletedAccount';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Account Name:'} | Select-Object -First 1) -replace '.*Account Name:\s*', ''}}, @{Name='DeletedBy';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Subject:' -A 3} | Where-Object {$_ -match 'Account Name:'} | Select-Object -First 1) -replace '.*Account Name:\s*', ''}}

3. Export events to CSV for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726} | Select-Object TimeCreated, LevelDisplayName, @{Name='Message';Expression={$_.Message}} | Export-Csv -Path "C:\Temp\AccountDeletions.csv" -NoTypeInformation

4. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726; StartTime=$StartTime; EndTime=$EndTime}

5. Search for deletions by specific administrator:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726} | Where-Object {$_.Message -match 'DOMAIN\\AdminUsername'}

In domain environments, correlate Event ID 4726 with other Active Directory events for complete context:

1. Check for related events on domain controllers:

   Get-WinEvent -ComputerName DC01 -FilterHashtable @{LogName='Security'; Id=4726,4728,4729,4732,4733} -MaxEvents 100 | Sort-Object TimeCreated

2. Query Directory Service log for additional context:

   Get-WinEvent -FilterHashtable @{LogName='Directory Service'} | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-1) -and $_.Message -match 'delete'}

3. Use Active Directory PowerShell module to check for recently deleted objects:

   Import-Module ActiveDirectory
   Get-ADObject -Filter {Deleted -eq $true} -IncludeDeletedObjects -Properties whenChanged,whenCreated,DisplayName | Where-Object {$_.whenChanged -gt (Get-Date).AddDays(-1)}

4. Check the Active Directory Recycle Bin if enabled:

   Get-ADObject -Filter {Deleted -eq $true -and ObjectClass -eq 'user'} -IncludeDeletedObjects -Properties DisplayName,whenChanged,LastKnownParent

5. Review Group Policy changes that might trigger automated deletions:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1502,1503} | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-1)}

Set up proactive monitoring to detect unauthorized account deletions:

1. Create a custom Event Viewer view for account deletions:
   • In Event Viewer, right-click Custom Views and select Create Custom View
   • Set Event level to Information
   • Enter 4726 in Event IDs
   • Select Security from Event logs
   • Name the view "Account Deletions" and save
2. Configure Windows Event Forwarding (WEF) to centralize events:

   # On collector server
   wecutil qc /q
   # Create subscription
   wecutil cs subscription.xml

3. Set up PowerShell-based monitoring script:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'Security' AND TargetInstance.EventCode = 4726" -Action {
       $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
       Send-MailMessage -To "admin@company.com" -From "monitoring@company.com" -Subject "Account Deleted" -Body "Account deletion detected: $($Event.Message)" -SmtpServer "mail.company.com"
   }

4. Configure Task Scheduler to run monitoring scripts:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorAccountDeletions.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   Register-ScheduledTask -TaskName "MonitorAccountDeletions" -Action $Action -Trigger $Trigger -RunLevel Highest

Perform detailed forensic analysis when unauthorized deletions are suspected:

1. Preserve evidence by exporting relevant events:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726; StartTime=(Get-Date).AddDays(-30)}
   $Events | Export-Csv -Path "C:\Forensics\AccountDeletions_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Analyze logon sessions associated with deletions:

   # Get logon events for the same session
   $LogonId = "0x3e7"  # Extract from 4726 event
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4634} | Where-Object {$_.Message -match $LogonId}

3. Check for privilege escalation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4673,4674} | Where-Object {$_.TimeCreated -gt (Get-Date).AddHours(-2) -and $_.TimeCreated -lt (Get-Date).AddMinutes(-5)}

4. Attempt account recovery from Active Directory Recycle Bin:

   # Find deleted user by SID or name
   $DeletedUser = Get-ADObject -Filter {Deleted -eq $true -and SamAccountName -eq 'username'} -IncludeDeletedObjects
   # Restore the account
   Restore-ADObject -Identity $DeletedUser

5. Generate comprehensive forensic report:

   $Report = @{
       DeletionEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4726; StartTime=(Get-Date).AddDays(-7)}
       RelatedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4634; StartTime=(Get-Date).AddDays(-7)}
       PrivilegeUse = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=(Get-Date).AddDays(-7)}
   }
   $Report | ConvertTo-Json -Depth 3 | Out-File "C:\Forensics\DeletionInvestigation.json"