All accounts disabled. No event 4725 RRS feed

  • Question

  • Hi

    Don't know if this is the correct fórum...I believe it is...

    Hope any help or direction on the following subject.

    I have na Active Directory with 5000+ users. Recently all users were disabled oneshot. This happens not in a periodically manner.

    I have activated auditing in AD to identify id 4725 (and all others related), to try to identify when and who (or what) could be possibly doing this.

    Today the situation repeated again without anything logged in the security log. However if we disable manualy a user using GUI or script the event is logged...

    Any help would be deeply apreciated.

    Best regards,

    Cristiano Fernandes

    Wednesday, September 21, 2016 2:38 PM