Event ID: 4725A user account was disabled
A user account was disabled. Subject: Security ID: %4 Account Name: %5 Account Domain: %6 Logon ID: %7 Target Account: Security ID: %3 Account Name: %1 Account Domain: %2
This event generates every time user or computer object is disabled.
For user accounts, this event generates on domain controllers, member servers, and workstations.
For computer accounts, this event generates only on domain controllers.
ISO 27001:2013 A.9.2.1
NIST 800-171: 3.1.1
NIST SP 800-53: AC-2 (4)
PCI 3.2.1: 10.2.5
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"User Account Management"
LEFT/RIGHT arrow keys for navigationBack to List