Solved

An Active Directory security group was deleted today. Is there an event ID I can look for an place in the event viewer I should look to find out what happened?

Posted on 2013-05-15
2
551 Views
Last Modified: 2013-05-17
We had an active directory security group vanish today and have to assume one of us deleted it by accident or with a script. Is there a place in the AD event viewer that would display what happened? Windows 2008 domain
0
Comment
Question by:Thor2923
2 Comments
 
LVL 18

Accepted Solution

by:
Sarang Tinguria earned 500 total points
ID: 39169463
If you have auditing enabled you may search security logs of DC
Find below events based upon security Group type

4754 A security-enabled universal group was created.
4730 A security-enabled global group was deleted.
4734 A security-enabled local group was deleted
0
 
LVL 3

Expert Comment

by:violageek
ID: 39173351
As mentioned if you have auditing enabled you can look for event id 564 and event id 634 and event id 638 that are all related to deletion of objects.

Ref: http://support.microsoft.com/kb/174074
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now