Just wanted to know Ad account activity who is disable the AD user account ?
You are looking for windows event id 4725 (2k8+ or 629 on 2k3)
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4725
TargetUserName
is the disabled account - SubjectuserName
is the user who performed the action.
Try this to test:
source=wineventlog:security EventID=4725|eval message="User ".TargetUserName." was disabled by ".SubjectUserName|table _time message
I should just note that you want to run this against your Domain Controller security events, rather than workstations etc.