It is my understanding that when a user account is deleted in AD an event should be generated with ID 4726 (assuming you have auditing enabled), however in my company this does not appear to be the case, and i'm wondering why. I just tested this after being unable to track down a user deletion earlier. When i delete a user account, the only event generated is 5141 (Directory Service Change). Am i missing something here? I have "Audit Account Management" set to success and failure. Everywhere i read online tells me a 4726 event should be generated but it is not.
Any help is greatly appreciated.