none
Create event logs for deleting user profiles from Windows server OS

    שאלה

  • Hi,

    I have an requirement from customer, they want to delete old user profiles in Windows server OS(path is C:\Users\.....) and want to generate an event log from the server for auditing purpose.

    For this I have already created PowerShell script to collect the user profile details from remote machine and then we are using another script to deleting user profiles.  Now we want to create an event log for deleting user profile.

    Can I know which type of event log is suitable to create a new events, for deleting each profile.

    What is the event ID to create the log?

    If anyone expertise on this can you please provide your suggestion or if someone already worked similar requirement and had documentation, then share me.

    If there is any add on details available from your end, please share those as well.

    Thanks.



    • נערך על-ידי d.jagadish יום רביעי 13 יוני 2018 15:03 Title correction
    יום רביעי 13 יוני 2018 14:12

כל התגובות

  • Enable Auditing on C:\Users folder. 

    https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/


    Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    יום חמישי 14 יוני 2018 00:03
  • Open “Event Viewer” console and go to “Windows Logs” ➔ “Security”. Search for the event ID: 4726 (user account deletion). Here is an article to track user and computer account deletions in Active Directory: https://www.lepide.com/how-to/track-user-and-computer-account-deletion-in-active-directory.html
    יום חמישי 14 יוני 2018 09:32