find out who deleted a group in AD (2008)

I have the basic auditing on our Domain Controller running server 2008. Someone deleted a couple of groups and I need to find out who.

How can I find out who removed those groups in Active Directory?
Who is Participating?

Improve company productivity with a Business Account.Sign Up

Mike KlineConnect With a Mentor Commented:
Yes if you have auditing configured then you will see that event telling you the group was deleted.  More info on the events here:

I can take a screenshot later this weekend from my lab if that helps


athomsfereConnect With a Mentor Commented:
You have to have the auditing enabled when the object is changed, do you know if you have done this?
willlandymoreAuthor Commented:
they're all listed as 'not defined' so I guess they haven't been turned on.

Is the one for "Audit directory service access" the one that will show deletions and where does it show up in then event logs?
Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to and use offer code ‘EXPERTS’ to get 10% off your first purchase.

willlandymoreAuthor Commented:
okay, I think I found it.

I think it's the "Audit Account Management" one but it says the default is to log success on Domain Controllers so that means if someone deleted the account I should have a success audit saying so
willlandymoreAuthor Commented:
yeah, if I knew which part of the tree it's showing up in that would be good so a picture might help. :)
Mike KlineCommented:
It would be in the security log on the DC.
willlandymoreAuthor Commented:
okay, that's the one I'm looking through now
willlandymoreAuthor Commented:
thanks for the help
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.