Windows Event ID 4746 – Microsoft-Windows-Security-Auditing: Computer Account Deleted

Start by examining the specific details of the Event ID 4746 occurrence to understand what computer account was deleted and by whom.

1. Open Event Viewer on the domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4746 using the filter option
4. Double-click the event to view detailed information
5. Review the following key fields:
   • Subject: User who deleted the account
   • Target Account: Computer account that was deleted
   • Additional Information: Privileges used for deletion

Use PowerShell to query recent computer account deletions:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4746} -MaxEvents 50 | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Computer';Expression={$_.Properties[5].Value}}

Cross-reference deletion events with creation events to understand the lifecycle of the deleted computer accounts.

1. Search for corresponding Event ID 4741 (computer account created) entries
2. Use PowerShell to correlate creation and deletion events:

# Get computer account deletions
$deletions = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4746} -MaxEvents 100

# Get computer account creations
$creations = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4741} -MaxEvents 500

# Correlate by computer name
foreach ($deletion in $deletions) {
    $computerName = $deletion.Properties[5].Value
    $matchingCreation = $creations | Where-Object {$_.Properties[5].Value -eq $computerName} | Select-Object -First 1
    if ($matchingCreation) {
        Write-Output "Computer: $computerName, Created: $($matchingCreation.TimeCreated), Deleted: $($deletion.TimeCreated)"
    }
}

3. Analyze the time span between creation and deletion to identify patterns
4. Look for unusually short-lived computer accounts that might indicate suspicious activity

Examine who performed the deletion and verify they had appropriate permissions for the action.

1. Extract the user information from the event details
2. Verify the user's group memberships and permissions:

# Get the user who deleted computer accounts
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4746} -MaxEvents 20
foreach ($event in $events) {
    $userName = $event.Properties[1].Value
    $domain = $event.Properties[2].Value
    Write-Output "Checking permissions for: $domain\$userName"
    
    # Check group memberships
    try {
        $user = Get-ADUser -Identity $userName -Properties MemberOf
        $user.MemberOf | ForEach-Object {
            $group = Get-ADGroup -Identity $_
            Write-Output "  Member of: $($group.Name)"
        }
    } catch {
        Write-Warning "Could not retrieve user information for $userName"
    }
}

3. Review if the user belongs to appropriate administrative groups (Domain Admins, Account Operators)
4. Check for any recent privilege escalations or unusual administrative access
5. Verify the deletion was performed during normal business hours and follows change management procedures

Examine patterns in computer account deletions to identify potential security concerns or operational issues.

1. Generate a comprehensive report of deletion activities over time:

# Analyze deletion patterns over the last 30 days
$startDate = (Get-Date).AddDays(-30)
$deletions = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4746; StartTime=$startDate}

# Group by user
$byUser = $deletions | Group-Object {$_.Properties[1].Value} | Sort-Object Count -Descending
Write-Output "Deletions by User:"
$byUser | ForEach-Object {
    Write-Output "$($_.Name): $($_.Count) deletions"
}

# Group by day
$byDay = $deletions | Group-Object {$_.TimeCreated.Date} | Sort-Object Name
Write-Output "`nDeletions by Day:"
$byDay | ForEach-Object {
    Write-Output "$($_.Name): $($_.Count) deletions"
}

# Check for bulk deletions (more than 10 in an hour)
$bulkDeletions = $deletions | Group-Object {$_.TimeCreated.ToString("yyyy-MM-dd HH")} | Where-Object {$_.Count -gt 10}
if ($bulkDeletions) {
    Write-Warning "Potential bulk deletion detected:"
    $bulkDeletions | ForEach-Object {
        Write-Output "$($_.Name): $($_.Count) deletions"
    }
}

2. Look for unusual spikes in deletion activity
3. Identify any deletions occurring outside normal maintenance windows
4. Cross-reference with change management tickets or scheduled maintenance

Set up proactive monitoring to detect and alert on suspicious computer account deletion activities.

1. Create a scheduled task to monitor for Event ID 4746:

# Create monitoring script
$monitorScript = @'
$events = Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4746; StartTime=(Get-Date).AddHours(-1)} -ErrorAction SilentlyContinue
if ($events) {
    $alertMessage = "Computer account deletion detected:`n"
    foreach ($event in $events) {
        $user = $event.Properties[1].Value
        $computer = $event.Properties[5].Value
        $time = $event.TimeCreated
        $alertMessage += "User: $user deleted computer: $computer at $time`n"
    }
    
    # Send alert (customize based on your alerting system)
    Write-EventLog -LogName Application -Source "AD Monitor" -EventId 1001 -Message $alertMessage -EntryType Warning
}
'@

# Save script to file
$monitorScript | Out-File -FilePath "C:\Scripts\Monitor-ComputerDeletions.ps1" -Encoding UTF8

2. Configure Windows Event Forwarding to centralize Event ID 4746 from all domain controllers
3. Set up custom event log filters in your SIEM solution
4. Create alerts for:

• Multiple deletions by the same user within a short timeframe
• Deletions by non-administrative users
• Deletions occurring outside business hours
• Bulk deletion operations exceeding normal thresholds

5. Implement automated backup of computer account information before deletion using PowerShell:

# Backup computer account details before deletion
function Backup-ComputerAccount {
    param([string]$ComputerName)
    
    try {
        $computer = Get-ADComputer -Identity $ComputerName -Properties *
        $backupData = @{
            Name = $computer.Name
            DistinguishedName = $computer.DistinguishedName
            SID = $computer.SID
            Created = $computer.Created
            LastLogonDate = $computer.LastLogonDate
            OperatingSystem = $computer.OperatingSystem
            Description = $computer.Description
        }
        
        $backupPath = "C:\ADBackups\ComputerAccounts\$ComputerName-$(Get-Date -Format 'yyyyMMdd-HHmmss').json"
        $backupData | ConvertTo-Json | Out-File -FilePath $backupPath
        Write-Output "Computer account backed up to: $backupPath"
    } catch {
        Write-Error "Failed to backup computer account: $($_.Exception.Message)"
    }
}