<div>
If auditing was enabled on the PC or the domain, you might have a chance. &nbsp;Other than that, I doubt it.
</div>


If auditing was enabled on the PC or the domain, you might have a chance.  Other than that, I doubt it.

<div>
Auditing was enabled, but what exactly should I be looking for? &nbsp;Is there a specific event ID?
</div>


Auditing was enabled, but what exactly should I be looking for?  Is there a specific event ID?

<div>
Probably this: <br />
<br />
Event ID 678 : Account mapped for logon.<br />

</div>


Probably this:

Event ID 678 : Account mapped for logon.


<div>
<div class="content wysiwyg-content">
Is there a way to figure out who (or what account) joined a specific computer to our domain? &nbsp;There is a computer on our domain that has alot of security violations that should have been corrected by the Technician joining that computer to the domain. &nbsp;So we want to figure out who it was. &nbsp;They usually log in to the PC with a local admin account and add it to the domain with a different domain admin account.
</div>
</div>


Is there a way to figure out who (or what account) joined a specific computer to our domain?  There is a computer on our domain that has alot of security violations that should have been corrected by the Technician joining that computer to the domain.  So we want to figure out who it was.  They usually log in to the PC with a local admin account and add it to the domain with a different domain admin account.

Joining Computer to a Domain

Windows 2000 is an operating system for use on both client and server computers. It is the successor to Windows NT 4.0, and is the last version of Microsoft Windows to display the "Windows NT" designation. Four editions of Windows 2000 were released (Professional, Server, Advanced Server, and Datacenter Server) that shared a core set of features, including many system utilities such as the Microsoft Management Console. All versions of the operating system support NTFS 3.0, Encrypting File System, as well as basic and dynamic disk storage. The Windows 2000 Server family includes support for Active Directory services, Distributed File System and fault-redundant storage volumes.