Finding who deleted an account and when

One of our key service accounts was deleted from our windows 2003 domain on the last 3 days.  I have domain techies on staff as well as a contractor who uses remote acess to get into the domain.  Is there a way I can pin down when the account was deleted and by whom?  What's the best way to keep track of this stuff so I can see who does what to our domain accounts.

Who is Participating?
Lee W, MVPTechnology and Business Process AdvisorCommented:
If you have Auditing enabled, you can look in your security event log for this info (assuming you have indicated account changes to be audited).  If not, you pretty much will never know in this case.  HOWEVER, if you enable it from this point forward, you'll know in the future.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.