Where would we know when a previlage has been granted to the user


  • A user was removed from the domain admin group. But today when I reviewed the same user account today it was a member of domain administrator group.


    I am not sure who have done it. Is there a way we could get to know who has done it and when.


    Help on this is highly appreciated.  

    Wednesday, July 17, 2013 12:38 PM


  • Hello,

    if you have removed the user account from the domain admins security group and he is back into the group please check with your colleagues. The account will not automatically be added to the group, except you run scripts that make accounts member of security groups.

    Maybe you have to enable logging on the DCs OUO and check the event viewer who is changing the group membership.

    Best regards

    Meinolf Weber
    Microsoft MVP - Directory Services
    My Blog:

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Wednesday, July 17, 2013 1:00 PM