Fomer ColleagueOU contents deleted

Posted on 2007-03-30
Medium Priority
Last Modified: 2010-04-20

In my ADS there is a OU called former Colleague in that we move in disabled user accounts suddenly i see today that all the users are deleted how can i find who deleted and from which machine this has happened.

Question by:bsharath
  • 2
LVL 30

Accepted Solution

LauraEHunterMVP earned 2000 total points
ID: 18822762
If you have auditing turned on for the "Directory Service Access" event category, this will appear in the Security logs in the Event Viewer on your domain controllers.

Though it may be shutting the barn door after the horse has bolted where this particular incident is concerned, here is a step-by-step KB for configuring auditing of Active Directory objects: http://support.microsoft.com/kb/814595/

Hope this helps.

Laura E. hunter - Microsoft MVP: Windows Server - Networking
LVL 11

Author Comment

ID: 18840894
Can we enable auditing on a win xp and win 2003 local machines.

How do i do this.


Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
The Windows Firewall provides an important layer of protection and a rich interface to configure it. Unfortunately, it lacks item level filtering. This article details my process of implementing firewall-as-code to reduce GPO bloat.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question