none
auditing event ID 4741 and 4743 Server 2012 R2 RRS feed

  • Question

  • GPO setting for auditing event ID 4741 and 4743.

    How can I audit for computer objects additions and deletions, we have had some random computers being removed from the domain and it seems that none of the admins say they did it. I have looked in the event viewer and do not see anything, just trying to find out when and who.

    So far I have in my Default Domain Policy under Policies/Windows Settings/Security Settings/Local Policies/Audit Policy/Audit account management set for Success, I have in ADSI Edit /Properties added a principal type:Success, and Applies to this object and all decendant objects. I have Write all properties, Delete and Delete Subtree checked for permissions only, according to all the online helps but it still is not auditing these events. Please advise I really want to find out who is removing this workstations.  Thanks in advance.

    Friday, September 29, 2017 7:14 PM

All replies

  • Hi,
    Have you checked if the group policy is applied successfully?
    And I would suggest to have a try configuring the same audit group policy in a GPO which is linked to DC OU, then see if the event is logged on DC’s event viewer.
    Please see:
    Tracing down user and computer account deletion in Active Directory
    https://blogs.technet.microsoft.com/abizerh/2010/05/27/tracing-down-user-and-computer-account-deletion-in-active-directory/
    Best regards, 
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 2, 2017 2:54 AM
    Moderator
  • 

    Hi,

    Just checking in to see if the information provided was helpful. And if the replies as above are helpful, we would appreciate you to mark them as answers, please let us know if you would like further assistance.

    Best Regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 9, 2017 8:21 AM
    Moderator
  • Hi,

    I am checking how the issue is going, if you still have any questions, please feel free to contact us.

    And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.

    Appreciate for your feedback.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, October 11, 2017 9:03 AM
    Moderator