We have an AD environment with 10+ domain controllers. The behavior that we're observing is that after an AD user account is created and we observe the 4720 Account Created event, it's followed shortly after by a 4726 Account Deleted event despite the account never being deleted and is still active in AD.

Has anyone else ever noticed this in a distributed AD environment. My first impression is that it might possibly have something to do with the AD controllers syncing, but I'm not sure why the process would spawn a 4726 event when the account was never actually deleted.

As of now we haven't tried anything to remediate this issue from occurring since we don't understand why this is happening.