> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/monitor-user-deletion.md).

# Monitor User Account Deletion

This lab deletes the temporary Active Directory account used throughout this section and reviews the related security event.

## Objective

Generate and review Event ID `4726`, which records that a user account was deleted.

## Confirm the Account Is No Longer Privileged

Before deleting `tempuser01`, verify that it is not a member of `Domain Admins` or any other privileged test group.

## Delete the Temporary Account

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Locate `tempuser01`.
3. Confirm that this is the temporary test account.
4. Right-click the account.
5. Select **Delete**.
6. Confirm the deletion.

## Find the Event

Open:

**Event Viewer > Windows Logs > Security**

Filter for:

```
4726
```

Open the newest event related to `tempuser01`.

## What to Review

Identify:

* who deleted the account
* which account was deleted
* the domain
* the event time

## Verification

The lab is complete when:

* `tempuser01` no longer appears in Active Directory Users and Computers
* Event ID `4726` is visible in the Security log
* the event identifies the administrator who performed the deletion

## Security Relevance

Unexpected account deletion can disrupt access and may also remove evidence or interfere with normal operations. In a real environment, account deletion should normally align with an approved identity lifecycle or change-management process.