Windows Account Disabled Detection

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•4

This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.