Windows Security Log Event ID 630

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryAccount Management
Type Success
Corresponding events
in Windows 2008
and Vista

630: User Account Deleted

On this page

Logged when one user (caller user) deletes another user account (target account).

Free Security Log Resources by Randy

Description Fields in 630

  • Target Account Name: %1
  • Target Domain: %2
  • Target Account ID: %3
  • Caller User Name: %4
  • Caller Domain: %5
  • Caller Logon ID: %6
  • Privileges: %7

Supercharger Enterprise


Examples of 630

User Account Deleted:
  Target Account Name: Dave
  Target Domain: MS0
  Target Account ID: %{S-1-5-21-1234561642-881234518-725345543-1010}
  Caller User Name: Administrator
  Caller Domain: ACME
  Caller Logon ID: (0x0,0xD44E)
  Privileges: -

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources