none
Active Directory account deleted RRS feed

  • Question

  • Hi

    Could some one please advise if there is a way of tracking who deleted an user account in active directory

    Friday, February 19, 2010 2:42 PM

Answers

  • Hi

    Filter you security log in the event viewr to the following

    Event ID : 630

    Target Account Name: deleted user

    Caller User Name   : the one whom deleted the account

    hope this help you


    Regards A.Karam
    Friday, February 19, 2010 6:45 PM
  • Hello,

    in addition to Abdel fatah Karam's information you have enable auditing for account management on a GPO on the domain controllers OU, other wise nothing will be logged on the DCs event viewers. Also you have to control ALL DCs to find it.
    Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
    Sunday, February 21, 2010 8:30 PM

All replies

  • Hi

    Filter you security log in the event viewr to the following

    Event ID : 630

    Target Account Name: deleted user

    Caller User Name   : the one whom deleted the account

    hope this help you


    Regards A.Karam
    Friday, February 19, 2010 6:45 PM
  • Hello,

    in addition to Abdel fatah Karam's information you have enable auditing for account management on a GPO on the domain controllers OU, other wise nothing will be logged on the DCs event viewers. Also you have to control ALL DCs to find it.
    Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
    Sunday, February 21, 2010 8:30 PM