Windows Event ID 4763 – Microsoft-Windows-Security-Auditing: User Account Deleted

Start by examining the specific event details to understand what account was deleted and by whom.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log by clicking Filter Current Log in the right pane
4. Enter 4763 in the Event IDs field and click OK
5. Double-click on an Event ID 4763 entry to view detailed information
6. Review the General tab for key details:
   • Target Account Name: The deleted user account
   • Target Domain: Domain or computer name
   • Target SID: Security identifier of deleted account
   • Subject Account Name: Who performed the deletion
   • Subject Domain: Domain of the deleting user
7. Check the timestamp to correlate with other security events
8. Note the Logon ID to track the session that performed the deletion

Use PowerShell to programmatically search and analyze Event ID 4763 occurrences across multiple systems.

1. Open PowerShell as Administrator
2. Query recent account deletion events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4763} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events by specific time range:

   $StartTime = (Get-Date).AddDays(-7)
   $EndTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4763; StartTime=$StartTime; EndTime=$EndTime}

4. Extract detailed information from event properties:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4763} -MaxEvents 10 | ForEach-Object {
       $Event = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           TargetUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'} | Select-Object -ExpandProperty '#text'
           TargetDomainName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetDomainName'} | Select-Object -ExpandProperty '#text'
           SubjectUserName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           SubjectDomainName = $Event.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectDomainName'} | Select-Object -ExpandProperty '#text'
       }
   }

5. Query multiple domain controllers simultaneously:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Invoke-Command -ComputerName $DC.Name -ScriptBlock {
           Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4763} -MaxEvents 10 -ErrorAction SilentlyContinue
       }
   }

Investigate related events to build a complete picture of the account deletion activity and identify potential security concerns.

1. Search for related logon events around the same time:

   $DeletionTime = (Get-Date '2026-03-18 10:30:00')
   $TimeWindow = 30 # minutes
   $StartTime = $DeletionTime.AddMinutes(-$TimeWindow)
   $EndTime = $DeletionTime.AddMinutes($TimeWindow)
   
   # Look for logon events (4624) and logoff events (4634)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4634; StartTime=$StartTime; EndTime=$EndTime}

2. Check for privilege use events (4672, 4673) that might indicate elevated operations:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672,4673; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Message -like '*SeSecurityPrivilege*' -or $_.Message -like '*SeTcbPrivilege*'}

3. Look for other account management events in the same timeframe:

   # Account management events: 4720 (created), 4722 (enabled), 4725 (disabled), 4726 (deleted)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4722,4725,4726,4763; StartTime=$StartTime; EndTime=$EndTime} | Sort-Object TimeCreated

4. Check for process creation events (4688) to identify tools used:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Message -like '*dsa.msc*' -or $_.Message -like '*powershell*' -or $_.Message -like '*dsrm*'}

5. Review Group Policy changes (4719) that might affect audit settings:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4719; StartTime=$StartTime; EndTime=$EndTime}

Ensure that account management auditing is properly configured to capture all relevant account deletion events.

1. Check current audit policy settings using auditpol:

   auditpol /get /category:"Account Management"

2. Verify specific subcategory settings for user account management:

   auditpol /get /subcategory:"User Account Management"

3. Review Group Policy settings for audit configuration:
   • Open Group Policy Management Console
   • Navigate to the relevant GPO (typically Default Domain Controllers Policy)
   • Go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Account Management and verify Audit User Account Management is set to Success and Failure
4. Check registry settings for audit configuration:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security" -Name MaxSize, Retention

5. Verify Security log size and retention settings:

   $LogConfig = Get-WinEvent -ListLog Security
   Write-Host "Maximum Size: $($LogConfig.MaximumSizeInBytes / 1MB) MB"
   Write-Host "Current Size: $($LogConfig.FileSize / 1MB) MB"
   Write-Host "Is Enabled: $($LogConfig.IsEnabled)"
   Write-Host "Log Mode: $($LogConfig.LogMode)"

6. Test audit policy by creating and deleting a test account:

   # Create test user
   New-LocalUser -Name "TestAuditUser" -NoPassword -Description "Test account for audit verification"
   # Delete test user
   Remove-LocalUser -Name "TestAuditUser"
   # Verify events were generated
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4720,4763} -MaxEvents 5

Set up automated monitoring to detect and alert on suspicious account deletion activities in real-time.

1. Create a PowerShell script for continuous monitoring:

   # Save as Monitor-AccountDeletions.ps1
   param(
       [int]$CheckIntervalMinutes = 5,
       [string]$AlertEmail = "admin@company.com",
       [string]$SMTPServer = "mail.company.com"
   )
   
   while ($true) {
       $StartTime = (Get-Date).AddMinutes(-$CheckIntervalMinutes)
       $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4763; StartTime=$StartTime} -ErrorAction SilentlyContinue
       
       if ($Events) {
           foreach ($Event in $Events) {
               $EventXML = [xml]$Event.ToXml()
               $TargetUser = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'TargetUserName'}).'#text'
               $SubjectUser = ($EventXML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'}).'#text'
               
               $AlertMessage = "ALERT: User account '$TargetUser' was deleted by '$SubjectUser' at $($Event.TimeCreated)"
               Write-Warning $AlertMessage
               
               # Send email alert (configure SMTP settings)
               # Send-MailMessage -To $AlertEmail -Subject "Account Deletion Alert" -Body $AlertMessage -SmtpServer $SMTPServer
           }
       }
       
       Start-Sleep -Seconds ($CheckIntervalMinutes * 60)
   }

2. Create a scheduled task to run the monitoring script:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-AccountDeletions.ps1"
   $Trigger = New-ScheduledTaskTrigger -AtStartup
   $Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount
   $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
   
   Register-ScheduledTask -TaskName "Monitor Account Deletions" -Action $Action -Trigger $Trigger -Principal $Principal -Settings $Settings

3. Configure Windows Event Forwarding for centralized monitoring:
   • On collector server, run: wecutil qc
   • Create subscription configuration file:

     <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
         <SubscriptionId>AccountDeletions</SubscriptionId>
         <SubscriptionType>SourceInitiated</SubscriptionType>
         <Description>Account Deletion Events</Description>
         <Enabled>true</Enabled>
         <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
         <Query><![CDATA[
             <QueryList>
                 <Query Id="0">
                     <Select Path="Security">*[System[EventID=4763]]</Select>
                 </Query>
             </QueryList>
         ]]></Query>
     </Subscription>

   • Create the subscription: wecutil cs AccountDeletions.xml
4. Set up SIEM integration using Windows Event Collector or direct log forwarding:

   # Configure winlogbeat for Elastic Stack integration
   # Edit winlogbeat.yml configuration
   event_logs:
     - name: Security
       event_id: 4763
       processors:
         - script:
             lang: javascript
             source: |
               function process(event) {
                   if (event.Get("winlog.event_id") === 4763) {
                       event.Put("event.category", ["iam"]);
                       event.Put("event.type", ["user", "deletion"]);
                   }
               }