Avatar of SBelmont2012
SBelmont2012
Flag for Afghanistan asked on

Who Deleted AD Account

Missing user accounts from AD, any way to tell what happen?
Anti-Virus AppsOS SecurityMicrosoft Server OS

Avatar of undefined
Last Comment
SBelmont2012

8/22/2022 - Mon
Andrej Pirman

Here's a nice blog article with a solution for you to play with:
http://blogs.technet.com/b/brad_rutkowski/archive/2006/09/21/hey-who-deleted-that-user-from-ad.aspx
Prashant Girennavar

Without Auditing enabled , it is impossible to check who has deleted the account.

http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/ba11d5a2-f30b-4163-913e-21f3941593c3/

If you want to restore the deleted the user account , please use the LDP.exe tool to do it , since each object in AD has some Thumstone life

http://technet.microsoft.com/en-us/library/dd581644(WS.10).aspx#restore_deleted_object_LDP

1.Log on to the Windows Server 2008 domain controller DC1 with Enterprise Admin or Domain Admin credentials.

2.Click Start, click Run, type ldp.exe, and then click OK.

3.Click Connection, and then click Connect.

4.Because you are logged on to the domain controller that hosts the forest root domain, click OK.

5.Click Connection again, and then click Bind.

6.Under Bind type, ensure that Bind as currently logged on user is selected, and then click OK.

7.Click View, and then click Tree. In BaseDN, type DC=Fabrikam,DC=com, and then click OK.

8.Click Options, and then click Controls. In the Load Predefined menu, click Return Deleted Objects, click Check Out, click Check In, and then click OK.

9.In the console tree, expand DC=Fabrikam,DC=com, double-click CN=Deleted Objects,DC=Fabrikam,DC=com, and then double-click CN=Arlene Huff\0ADEL:{objectGUID},CN=Deleted Objects,DC=Fabrikam,DC=com to open the object properties.

10.Right-click CN=Arlene Huff\0ADEL:objectGUID,CN=Deleted Objects,DC=Fabrikam,DC=com, and then click Modify.

11.In the Modify dialog box, do the following:

a.In Edit Entry Attribute, type isDeleted.


b.Under Operation, click Delete, and then click Enter.


c.Return to Edit Entry Attribute, and then type distinguishedName. (If the text isDeleted is still present in the box, remove it.)


d.In the details pane, under Dn: CN=Arlene Huff\0ADEL:objectGUID,CN=Deleted Objects,DC=Fabrikam,DC=com, copy the value for the lastknownParent attribute, and then paste it in Values. Amend this text with the CN of Arlene Huff, minus the mangled portion (\0ADEL:objectGUID) of the distinguished name, for example:

CN=Arlene Huff,OU=Finance,DC=Fabrikam,DC=com


12.Under Operation, click Replace, click Enter, ensure that the Extended check box is selected, and then click Run. You will see a confirmation message.

13.Click Close to close the Modify dialog box, and then minimize LDP.

14.Open the Active Directory Users and Computers snap-in. To open Active Directory Users and Computers, click Start, click Run, type dsa.msc, and then click OK.

15.Click the Finance OU, and ensure that the user Arlene Huff is present.

Regards,

_Prashant_
ASKER CERTIFIED SOLUTION
mo_patel

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
SBelmont2012

ASKER
mo_patel!  THANK YOU
Your help has saved me hundreds of hours of internet surfing.
fblack61