Event ID 4726: A user account was deleted (Security)

Cosa registra davvero questo Event ID su disco, i campi EventData da leggere per primi e dove si colloca in un workflow di triage DFIR.

Canale: Security
Provider: Windows\Security
Note di triage: Cleanup signal — often paired with 4720 minutes earlier.

Microsoft Learn

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726Apri la documentazione ufficiale ↗