An Active Directory security group was deleted today. Is there an event ID I can look for an place in the event viewer I should look to find out what happened?

We had an active directory security group vanish today and have to assume one of us deleted it by accident or with a script. Is there a place in the AD event viewer that would display what happened? Windows 2008 domain
LVL 1
Thor2923Asked:
Who is Participating?
 
Sarang TinguriaConnect With a Mentor Sr EngineerCommented:
If you have auditing enabled you may search security logs of DC
Find below events based upon security Group type

4754 A security-enabled universal group was created.
4730 A security-enabled global group was deleted.
4734 A security-enabled local group was deleted
0
 
violageekCommented:
As mentioned if you have auditing enabled you can look for event id 564 and event id 634 and event id 638 that are all related to deletion of objects.

Ref: http://support.microsoft.com/kb/174074
0
All Courses

From novice to tech pro — start learning today.