Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 281
  • Last Modified:

How to Tell WHO unlocked and/or enabled a locked and/or disabled active directory account

I have an active directory account that was locked on a particular day I am being asked to find out who unlocked the account in question.

Thanks.
0
dowhatyoudo22
Asked:
dowhatyoudo22
2 Solutions
 
Tony GiangrecoCommented:
If you have that level of logging enabled in the default domain GPO security settings, you will find it in the event viewer within the system log.

If the logging is not set, there is no audit to look for.
0
 
Mike KlineCommented:
You have to enable auditing then search your security logs.  are you on 2008 or higher...advanced audit settings can help

http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

So once you have it on how do you search through all the logs (especially in a big org).  Eventcomb (free microsoft tool) can help.  There are also good 3rd party tools that can make that search easier.

Thanks

Mike
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now