Windows Security Log Event ID 630

Operating Systems Windows Server 2000
Windows 2003 and XP
CategoryAccount Management
Type Success
Corresponding events
in Windows 2008
and Vista
Discussions on Event ID 630
Deleting account by different ways

630: User Account Deleted

On this page

Logged when one user (caller user) deletes another user account (target account).

Free Security Log Resources by Randy

Description Fields in 630

  • Target Account Name: %1
  • Target Domain: %2
  • Target Account ID: %3
  • Caller User Name: %4
  • Caller Domain: %5
  • Caller Logon ID: %6
  • Privileges: %7

Supercharger Free Edition


Examples of 630

User Account Deleted:
  Target Account Name: Dave
  Target Domain: MS0
  Target Account ID: %{S-1-5-21-1234561642-881234518-725345543-1010}
  Caller User Name: Administrator
  Caller Domain: ACME
  Caller Logon ID: (0x0,0xD44E)
  Privileges: -

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Upcoming Webinars
    Additional Resources