Event ID 4726: A User Account Was Deleted [Fix]

Enable auditing using the ADSI Edit when you get this event ID

5 min. read

Updated onOctober 4, 2023

updated onOctober 4, 2023

Share this article

Improve this guide

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

Key notes

Some of our readers complain about seeing the Windows security event 4726 in the Domain Controller. The event log indicates A user account was deleted and other details about the recorded event. However, this guide will take you through how to fix the event ID.

Also, you can read about theevent ID 7023 errorand some fixes to resolve it on Windows 11.

What is event 4726?

Event ID 4726 is a Windows security event that indicates the deletion of a user account. When this event is logged, a user account was removed or deleted from the Windows Active Directory.

This event is typically recorded in the security event log on a Windows domain controller.

By monitoring Event ID 4726, system administrators can keep track of user account deletions in their Windows domain environment and identify any unauthorized or suspicious activities related to user accounts.

What causes the event ID 4726?

Various factors can cause event ID 4726. Here are some common scenarios that may trigger this event:

These factors can vary on different computers. Regardless, we’ll discuss some basic fixes to resolve the problem.

What can I do if I see event ID 4726?

1. Enable auditing using the ADSI Edit

When you get the event ID 4726, you must track the deleted user and computer accounts. It has to be done by enabling the auditing in Active Directory Service Interface (ADSI).

2. Use Event Viewer to check deleted user accounts and computers in AD

Once you have enabled auditing, the Event Viewer will log deleted computer and user objects.

3. Use PowerShell to detect who deleted the account

In conclusion, we have a comprehensive guide on how toclear the event logon Windows computers. Also, read about whatevent ID 4769is and how to fix it.

If you have further questions or suggestions, kindly drop them in the comments section.

Event ID 4726: A User Account Was Deleted [Fix]#

What is event 4726?#

What causes the event ID 4726?#

What can I do if I see event ID 4726?#

1. Enable auditing using the ADSI Edit#

2. Use Event Viewer to check deleted user accounts and computers in AD#

3. Use PowerShell to detect who deleted the account#