The event ID for a Windows user account being enabled is 4720.
This event is logged in the Security event log and indicates that a user account has been enabled. It provides information about the user account, the time of the event, and the user who performed the action.
Here are some key details about Event ID 4720:
- Source: Security
- Event ID: 4720
- Task Category: Account Management
- Level: Information
- Keywords: Audit Success
- Description: This event indicates that a user account was enabled.
You can use this event ID to monitor user account activity and identify potential security issues. For example, if you see a large number of Event ID 4720 events, it could indicate that someone is trying to enable multiple user accounts, which could be a sign of malicious activity.
