user account created deleted in a very short period

Malhotra, GurupreetSingh 31 Reputation points
2021-02-03T16:20:01.87+00:00

Hello Team,

When an account is created we have observe event id 4720 however within 10 sec we observe another event id 4726. This cycle is observed twice and then the actual id creation ids are observed. We have not deleted the user id however the events generated shows the id was deleted. Can you please assist if this is a normal instance or so.

Microsoft Entra
{count} votes

1 answer

Sort by: Most helpful
  1. Marilee Turscak-MSFT 34,626 Reputation points Microsoft Employee
    2021-02-04T00:49:02.8+00:00

    Hi @Malhotra, GurupreetSingh ,

    If you have auditing configured on the domain controller, you should be able to check the Event properties to see details about what caused the account to be deleted. You can see if a particular person deleted it.

    63712-image.png

    https://social.technet.microsoft.com/wiki/contents/articles/17056.active-directory-event-ids-when-a-user-account-is-deleted.aspx