This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 93%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMG%3C/text%3E%3C/svg%3E)
Hello Team,
When an account is created we have observe event id 4720 however within 10 sec we observe another event id 4726. This cycle is observed twice and then the actual id creation ids are observed. We have not deleted the user id however the events generated shows the id was deleted. Can you please assist if this is a normal instance or so.
user account was created by copy option. Is there an anomaly or why the id gets deleted and created again
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 72%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPV%3C/text%3E%3C/svg%3E)
In my case it’s not within 10 sec, it’s within fraction of second though id created one time only. It’s strange and not observed before.
And user created using ADUC
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(102.4, 69%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
I have the same issue log event when i create an account shows that the account created then another log event says account deleted within 10 secs or less
Hi All,
I am having this issue on an environment as well. Did anyone of you find out what was going on, and perhaps found a solution for this?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Hi @Malhotra, GurupreetSingh ,
If you have auditing configured on the domain controller, you should be able to check the Event properties to see details about what caused the account to be deleted. You can see if a particular person deleted it.
The same user id is showing for all creation and deletion events for single user id creation. Activity is for single user id creation but logs of creation and deletion is getting generated for the same id.