Windows Event ID 4759 – Microsoft-Windows-Security-Auditing: User Account Deleted

Start by examining the event details to understand the context of the account deletion.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 4759 in the Event IDs field and click OK
5. Double-click on a 4759 event to view detailed information
6. Review the Subject section to identify who deleted the account
7. Check the Target Account section to see which account was deleted
8. Note the timestamp and correlate with any scheduled maintenance or administrative activities

Use PowerShell to programmatically search and analyze account deletion events across multiple systems.

1. Open PowerShell as Administrator
2. Query recent account deletion events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4759} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4759; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed information from events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4759} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           SubjectUserName = $Event.Event.EventData.Data[1].'#text'
           SubjectDomainName = $Event.Event.EventData.Data[2].'#text'
           TargetUserName = $Event.Event.EventData.Data[5].'#text'
           TargetDomainName = $Event.Event.EventData.Data[6].'#text'
       }
   }

5. Export results to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4759} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\AccountDeletions.csv" -NoTypeInformation

Investigate the broader context by examining related events that occurred around the same time as the account deletion.

1. Identify the Logon ID from the 4759 event details
2. Search for logon events using the same Logon ID:

   $LogonId = "0x3e7"  # Replace with actual Logon ID from 4759 event
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} | Where-Object {$_.Message -like "*$LogonId*"}

3. Look for privilege escalation events (4672) associated with the session:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672} | Where-Object {$_.Message -like "*$LogonId*"}

4. Check for other account management events in the same timeframe:

   $TimeWindow = (Get-Date).AddHours(-2)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4722,4724,4726,4738,4740,4767,4781; StartTime=$TimeWindow}

5. Review process creation events (4688) to identify tools used:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$TimeWindow} | Where-Object {$_.Message -like "*net.exe*" -or $_.Message -like "*powershell*"}

Set up proactive monitoring to detect and alert on suspicious account deletion activities.

1. Create a scheduled task to monitor for Event ID 4759:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\MonitorAccountDeletions.ps1"
   $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 15) -RepetitionDuration (New-TimeSpan -Days 365)
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   Register-ScheduledTask -TaskName "Monitor Account Deletions" -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM"

2. Create the monitoring script at C:\Scripts\MonitorAccountDeletions.ps1:

   # Monitor for recent account deletions
   $LastCheck = (Get-Date).AddMinutes(-20)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4759; StartTime=$LastCheck} -ErrorAction SilentlyContinue
   
   if ($Events) {
       foreach ($Event in $Events) {
           $EventXML = [xml]$Event.ToXml()
           $Subject = $EventXML.Event.EventData.Data[1].'#text'
           $DeletedAccount = $EventXML.Event.EventData.Data[5].'#text'
           
           # Send alert (customize as needed)
           Write-EventLog -LogName Application -Source "Account Monitor" -EventId 1001 -EntryType Warning -Message "Account deletion detected: $DeletedAccount deleted by $Subject at $($Event.TimeCreated)"
       }
   }

3. Configure Windows Event Forwarding for centralized monitoring:

   winrm quickconfig
   wecutil qc

4. Create a custom event subscription XML file for Event ID 4759 collection
5. Set up email notifications using PowerShell and SMTP for critical deletions

Perform detailed forensic analysis when unauthorized account deletions are suspected.

1. Export all security events for the relevant timeframe:

   $StartTime = (Get-Date "2026-03-15 00:00:00")
   $EndTime = (Get-Date "2026-03-18 23:59:59")
   Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=$StartTime; EndTime=$EndTime} | Export-Clixml -Path "C:\Forensics\SecurityEvents_$(Get-Date -Format 'yyyyMMdd').xml"

2. Analyze the SAM registry hive for deleted account artifacts:

   # Check SAM registry for account remnants
   Get-ChildItem "HKLM:\SAM\SAM\Domains\Account\Users" -ErrorAction SilentlyContinue

3. Review backup systems to identify when the account was last present:

   # Query backup metadata if available
   Get-WBBackupSet | Where-Object {$_.BackupTime -ge $StartTime}

4. Document the incident timeline using event correlation:

   # Create incident timeline
   $IncidentEvents = @(4624, 4625, 4648, 4672, 4720, 4726, 4759, 4688)
   $Timeline = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=$IncidentEvents; StartTime=$StartTime; EndTime=$EndTime} | Sort-Object TimeCreated
   $Timeline | Select-Object TimeCreated, Id, LevelDisplayName, @{Name='Summary';Expression={$_.Message.Split("`n")[0]}} | Export-Csv -Path "C:\Forensics\IncidentTimeline.csv"

5. Prepare account recovery procedures if the deletion was unauthorized:
   • Restore from Active Directory Recycle Bin if domain-joined
   • Recreate account with appropriate permissions and group memberships
   • Review and restore any associated user profile data from backups
   • Update security policies to prevent similar incidents