Account Deleted
Enabled by default
Service: Microsoft Windows Security auditing
Log type: Security
An attacker may attempt to tidy up after themselves by deleting an account or simply disrupt normal workflow by deleting legitimate accounts.
Get-WinEvent -FilterHashTable @{LogName='Security';ID='4726'} -MaxEvents 1 | Format-List auditpol /get /subcategory:"computer account management"
auditpol /set /subcategory:"computer account management" /Success:Disable /Failure:Disable
auditpol /set /subcategory:"computer account management" /Success:Enable /Failure:Enable
Compliance
HIPAA
Level: Recommended
PCI DSS
Level: Required
https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf?agreement=true&time=1631643252599
NSA Event Forwarding
Level: Recommended
https://github.com/nsacyber/Event-Forwarding-Guidance/tree/master/Events
Windows 10 Professional logs this by default. To view this log, navigate to the security tab of the Event Viewer. Sort or filter the logs for the event ID 4726.
To view this log from the command line with Get-WinEvent, launch powershell as an administrator. Enter the command Get-WinEvent -FilterHashTable @{LogName='Security';ID='4726'} -MaxEvents 1 | Format-List
To view this log from the command line with wevtutil, launch powershell or the command prompt as an administrator. Enter the command wevtutil qe Security "q:\*[System [(EventID=4726)]]"
