Active Directory 2008

Posted on 2011-10-06
Last Modified: 2012-05-12
Hi, a User has been created in AD, SBS 2008. the user is called ACCESS and has full admin rights. I know i never created this user.

The user has logged onto both the DC and TS servers.

Is there a way I can check to see when this user account was created, just after a date or date range.

Question by:DansamCS
    LVL 7

    Expert Comment

    Open active directory, click on view at the top click add remove columns search for modified date and add it to the list
    LVL 12

    Expert Comment

    You can verify the date of creation for an object in Active directory Users and Computers in menu View - Select Advanced Features

    Then Select the object ACCESS, enter properties, select tab object and there you should view the creation date.
    LVL 95

    Expert Comment

    by:Lee W, MVP
    I hope this is obvious... but just in case... CHANGE ALL YOUR PASSWORDS NOW.  And disable that account.
    LVL 24

    Accepted Solution

    Check the security log on the DC for below events this will give account creation date,the person who has created,etc.

    Event id 4720 will be generated  on windows 2008 for account creation.
    Event id 624 will be generated on windows 2003/2000  for account creation.


    This event will be generated if you have enabled Audit account management in the Default Domain Controller GPO.Also if the event is older it might get purge and you want be able to see the same even if the policy is enabled.

    I would also recommed to enable Audit Directory Service Access if not enabled.This will give evidence if any change to Directory service is made,example delete of dns zone,changes to Active directory object,etc


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
    Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
    In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now