How to Tell WHO unlocked and/or enabled a locked and/or disabled active directory account

I have an active directory account that was locked on a particular day I am being asked to find out who unlocked the account in question.

Who is Participating?
Mike KlineConnect With a Mentor Commented:
You have to enable auditing then search your security logs.  are you on 2008 or higher...advanced audit settings can help

So once you have it on how do you search through all the logs (especially in a big org).  Eventcomb (free microsoft tool) can help.  There are also good 3rd party tools that can make that search easier.


Tony GiangrecoConnect With a Mentor Commented:
If you have that level of logging enabled in the default domain GPO security settings, you will find it in the event viewer within the system log.

If the logging is not set, there is no audit to look for.
All Courses

From novice to tech pro — start learning today.