How do I find out who disabled an account in AD?

How do I find out who disabled an account in AD?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
How do I find out who disabled an account in AD? Ed02862 07-21-2005
Posted by =?Utf-8?B?RWQwMjg2Mg==?= on July 21, 2005, 10:33 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Somebody disabled a user account in AD. I need to find out who did it. I've
been using event comb to search for the user ID in the security and system
logs on our domain controllers. I can pretty much tell the last time the ID
was used but, i don't know what to search for to find out WHO disabled it.
I'm not really the security guy but, because of vacations, I've been charged
with this task.

Thanks in advance for any help anyone can provide.

Ed

Posted by =?Utf-8?B?V29uZyBUdWNrIFdhaA== on July 21, 2005, 10:43 am
If you were  Registered and logged in, you could reply and use other advanced thread options
If you have enabled the "audit directory service object" policy, all access
to AD objects will log in security log.

Search for this disabled object and look at the details inform. Pay
emphasize on the time, date, user and computer attributes. It will tell you
the object is disabled by which user on which computer.

HTH.


Similar ThreadsPosted
how to find Active desktop Enabled\disabled? October 31, 2007, 8:10 am
how to find Active desktop Enabled\disabled? October 31, 2007, 8:14 am
Disabled User Account October 21, 2005, 3:48 pm
How to enable Auditing to trace who disabled user's account. January 20, 2006, 12:05 pm
Re-enaled disabled account Exchange 1022 error 2147221231 September 29, 2006, 10:39 am
Anyway to find out? November 28, 2007, 4:52 pm
70 GB of Files I can't Find December 14, 2007, 11:37 am
Wallpaper Changed And Disabled June 19, 2005, 9:52 pm
Security Center is disabled? August 6, 2006, 6:27 pm
Re: Security Center is disabled? August 7, 2006, 1:13 am

The site map in XML format XML site map

Contact Us | Privacy Policy