Event ID 4722 to 4726: account enabled, password changed or reset, disabled, deleted
After a new account (4720), these five events cover its life: enabled, password changed or reset, disabled, deleted. A reset password on an admin account or a long-disabled account that suddenly comes back are two of the clearest signs that someone is taking over an account.
- 4722 enabled · 4723 a user changed their own password · 4724 someone reset a password · 4725 disabled · 4726 deleted.
- Who and whom: Subject did it, Target Account is the account it was done to.
- Audit subcategory User Account Management, on by default.
- Suspicious: a reset (4724) of an admin account by someone else, a disabled account enabled again (4722), deletions right after an incident.
1. PowerShell: account changes of the last 30 days
function Get-EventFields($e) { $d = [ordered]@{}; ([xml]$e.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }; [pscustomobject]$d }
$what = @{ 4722 = 'enabled'; 4723 = 'own password changed'; 4724 = 'password reset'; 4725 = 'disabled'; 4726 = 'deleted' }
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4722,4723,4724,4725,4726; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
ForEach-Object { $f = Get-EventFields $_
[pscustomobject]@{ Time = $_.TimeCreated; What = $what[$_.Id]; Account = "$($f.TargetDomainName)\$($f.TargetUserName)"; By = $f.SubjectUserName } } |
Sort-Object Time | Format-Table -AutoSizeFor domain accounts run it on the domain controllers – each logs its own changes.
2. 4723 versus 4724
4723 means a user changed their own password (they knew the old one). 4724 means someone reset it – an administrator, a help-desk tool, or an attacker with enough rights. A 4724 for an administrator account that nobody asked for is a strong warning sign: whoever did it can now log on as that account.
Both are written for attempts; failed attempts appear as Audit Failure.
3. Patterns worth a look
- 4722 for an account disabled for months (old employee, old service account), followed by a logon.
- 4724 for Administrator or a Domain Admin by an account that does not normally reset passwords.
- 4725 / 4726 for many accounts at once – sabotage, or an attacker locking you out.
- 4726 for an account created shortly before (4720) – covering tracks.
4. Let Coinetic watch it for you
Coinetic works where most of these logons start – on the way in:
- Password guessers are banned automatically by a Windows Firewall rule after a few failed logons – Remote Desktop, Windows logons, VPN, SQL Server and more.
- Remote Desktop invisible until you need it: the port stays closed and opens only after you unlock it from your phone.
- Ask AI (Pro + AI): “Is someone guessing passwords on this Server?” – answered in plain words from this computer's failed logons and bans.
Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.
More guides: all Coinetic guides.
Frequently asked
Does 4724 show the new password?
No. Passwords are never written to any event log.
Why do I see 4738 together with these events?
4738 (user account changed) is written for many attribute changes, including the ones these events report. It lists which attributes changed.
A user reset their password through self-service - which event?
Usually 4724, with the self-service tool's service account as Subject, because the tool resets it on the user's behalf.