find out who deleted a group in AD (2008)

I have the basic auditing on our Domain Controller running server 2008. Someone deleted a couple of groups and I need to find out who.

How can I find out who removed those groups in Active Directory?
LVL 1
willlandymoreAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Mike KlineConnect With a Mentor Commented:
Yes if you have auditing configured then you will see that event telling you the group was deleted.  More info on the events here:

http://technet.microsoft.com/en-us/library/cc737542(WS.10).aspx

I can take a screenshot later this weekend from my lab if that helps

thanks

Mike
0
 
athomsfereConnect With a Mentor Commented:
You have to have the auditing enabled when the object is changed, do you know if you have done this?

http://technet.microsoft.com/en-us/library/cc731607%28WS.10%29.aspx
0
 
willlandymoreAuthor Commented:
they're all listed as 'not defined' so I guess they haven't been turned on.

Is the one for "Audit directory service access" the one that will show deletions and where does it show up in then event logs?
0
Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

 
willlandymoreAuthor Commented:
okay, I think I found it.

I think it's the "Audit Account Management" one but it says the default is to log success on Domain Controllers so that means if someone deleted the account I should have a success audit saying so
0
 
willlandymoreAuthor Commented:
yeah, if I knew which part of the tree it's showing up in that would be good so a picture might help. :)
0
 
Mike KlineCommented:
It would be in the security log on the DC.
0
 
willlandymoreAuthor Commented:
okay, that's the one I'm looking through now
0
 
willlandymoreAuthor Commented:
thanks for the help
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.