Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 284
  • Last Modified:

How to Tell WHO unlocked and/or enabled a locked and/or disabled active directory account

I have an active directory account that was locked on a particular day I am being asked to find out who unlocked the account in question.

Thanks.
0
dowhatyoudo22
Asked:
dowhatyoudo22
2 Solutions
 
Tony GiangrecoCommented:
If you have that level of logging enabled in the default domain GPO security settings, you will find it in the event viewer within the system log.

If the logging is not set, there is no audit to look for.
0
 
Mike KlineCommented:
You have to enable auditing then search your security logs.  are you on 2008 or higher...advanced audit settings can help

http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

So once you have it on how do you search through all the logs (especially in a big org).  Eventcomb (free microsoft tool) can help.  There are also good 3rd party tools that can make that search easier.

Thanks

Mike
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now