none
Computer Account is getting deleted automatically RRS feed

  • Question

  • We found that few of computer accounts are getting deleted automatically, we rejoined again to DC but again after few days it is getting deleted again.

    Could someone please guide me on how to troubleshoot the issue as there is no third party auditing tool is running in environment.  


    MCP, MCTS

    Tuesday, February 2, 2016 3:43 PM

Answers

  • > We found that few of computer accounts are getting deleted
    > automatically
     
    I'm absolutely sure that this is NOT automatically :)
     
    > Could someone please guide me on how to troubleshoot the issue as there
    > is no third party auditing tool is running in environment.
     
    Enable Windows AD Auditing for object deletion. Search for
    Event ID 4743    Success    A computer account was deleted.
     
    Tuesday, February 2, 2016 3:47 PM
  • If it is automatically done then you should have a program or a script that is doing that. Enable the auditing and look the the events registered in event viewer for investigation.

    This posting is provided AS IS with no warranties or guarantees , and confers no rights.

    Ahmed MALEK

    My Website Link

    My Linkedin Profile

    My MVP Profile

    Wednesday, February 3, 2016 12:35 AM
  • Hi,

    As others have suggest, if you have auditing enabled in the AD, you can track the deletion of the computer account deletion.

    In order to find out about user and computer account deletion, you must keep the “Account Management” auditing enabled, beforehand. You could refer to the following article to get more information:

    Tracing down user and computer account deletion in Active Directory

    http://blogs.technet.com/b/abizerh/archive/2010/05/27/tracing-down-user-and-computer-account-deletion-in-active-directory.aspx

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, February 3, 2016 1:49 AM
    Moderator

All replies