> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-account-enable-disable.md).

# Monitor Account Enable and Disable Actions

This lab shows how Windows records changes to the enabled state of an Active Directory user account.

## Objective

Generate and review these events:

* Event ID `4725` when a user account is disabled
* Event ID `4722` when a user account is enabled

## Disable the Test Account

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Locate `tempuser01`.
3. Right-click the account.
4. Select **Disable Account**.
5. Confirm the action.

## Find the Disable Event

Open:

**Event Viewer > Windows Logs > Security**

Filter for:

```
4725
```

Open the newest matching event and review:

* who disabled the account
* which account was disabled
* the domain
* the event time

## Enable the Test Account Again

Return to **Active Directory Users and Computers**.

1. Right-click `tempuser01`.
2. Select **Enable Account**.

Then return to Event Viewer and filter for:

```
4722
```

Review the newest event.

## Compare the Events

Compare Event ID `4725` with Event ID `4722`.

Both events should show the administrator or account that performed the change and the account that was affected.

## Verification

The lab is complete when you can identify both the disable and enable events for `tempuser01`.

Leave `tempuser01` enabled so it can be used in the next exercises.

## Security Relevance

Unexpected account disable or enable activity can affect availability and access. Re-enabling a disabled account can also be important when an account was intentionally suspended because of termination, investigation, or security concerns.