find audit of users removed from admin group

does event viewer track when users are removed from admin group in OS R2? if so, where can we find it?

thanks
LVL 6
anushahannaAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
alreadyinuseConnect With a Mentor Commented:
If you are talking about 2008 R2 it would be in the security event log if AD auditing is enabled and if you are talking about the AD administrators group as the group where the user was removed from.
0
 
anushahannaAuthor Commented:
how can i confirm if AD auditing is enabled? and what would the event name be?
0
 
anushahannaAuthor Commented:
thanks alreadyinuse- it helped to set it up.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.