Query deleted users object from Active Directory

Hi Team,

I am trying to get a report on how many AD users account are deleted, When it was deleted, Last Known OU, Who deleted..
Name etc. I want only user object and Deleted= true. Please help.
I tried with few of my scripts but it did not work for me. I have a challenge when ever an Ad account is deleted we do not know who has deleted it and when it was deleted.

Pavan Joshi
Pavan JoshiAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
When accounts get modified or deleted you need to resotre to the security Logs on the domain controllers which will outline exactly when/who modified the account or deleted it.

Without Auditing Enabled you will not be able to find this level of detail that you are after. Auditing is not enabled by default. I have created a HowTo on my site which illustrates how to enable Auditing for Active Directory see link below.


Once you have auditing enabled you will also need to move the Security logs from the domain controllers to a central location (logging server) where you can then go through them. This can be a tidious task if you have more then 2 DC's in your environment because esentially the change could have been made on any DC and only that DC will have the logs for this change speciifically.

I would recommend using a 3rd party software called ActiveDirectory Auditor by Ledpie Software.

Also just as a side note, if you want to see the accounts that have already been deleted you can use the Get-ADObject IsDelete Property which will tell you if the adobject is in the DeletedItems Container (hidden) in Acitve Directory.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Pavan JoshiAuthor Commented:
Thanks for the solution :) Will :)
Will SzymkowskiSenior Solution ArchitectCommented:
Glad to help!

Pavan JoshiAuthor Commented:
Is there any other way that I can find if central location (logging server) exists in my environment. We have 40 + DC as of now....
Will SzymkowskiSenior Solution ArchitectCommented:
You can use Event Log Subscriptions. This is something that was introduced in Server 2008.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.