Link to home
Start Free TrialLog in
Avatar of jyoung127
jyoung127

asked on

Windows 2012 Conputer account Deleted

Is there a way to find out what user account deleted a computer Account in AD?

Windows 2012 R2, Domain  function level is  at windows 2008.
Avatar of Cliff Galiher
Cliff Galiher
Flag of United States of America image

Auditing is not turned on by default, so unless you had previously configured it, no. That information is not logged or tracked. And since you are asking, it is usually a safe conclusion that auditing was never configured.
Have you enabled 2012 Ad Recycle Bin?  If not, do so for future issues.
Plenty of articles on how to do this, for example:
http://blogs.technet.com/b/canitpro/archive/2013/04/10/step-by-step-enabling-active-directory-recycle-bin-in-windows-server-2012.aspx
Avatar of jyoung127
jyoung127

ASKER

Let me understand other than using windows Audit there is not other way of tracking who deletes a computer in AD?  EX PowerShell?

I had auditing for users turn on but did not for computers.

I plan on Moving the  function level  of the domain to windows 2008 R2 soon so I can turn on Recycle bIn for AD.
ASKER CERTIFIED SOLUTION
Avatar of Cliff Galiher
Cliff Galiher
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial