*raises hand*
sid of the last modify-er would be just nice for
me.
Usually we just want to know which admin is the culprit
without analyzing 30gig of DC security log (one day log)
Thank you and have a splendid day!
Kind Regards,
Freddy Hartono
Group Support Engineer
InternationalSOS Pte Ltd
mail:
[EMAIL PROTECTED]
phone:
(+65) 6330-9740 - temp
From: joe [mailto:[EMAIL PROTECTED]
Sent: Friday, October 14, 2005 11:03 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Knowing when users were deleted.
Correct, you can currenlty only get the when and the where
(DC Where not Client Where).
Which raises the question. How many people would like a
metadata stamp with the GUID or SID of the userid that made the modification for
a given attribute (or value if appropriate)? Or would it be ok to just have who
made the last change to the object? Either way, none of the "administrators
group" nonsense, it points to a specific security principal.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Freddy HARTONO
Sent: Friday, October 14, 2005 3:18 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Knowing when users were deleted.
Hi Yann,
You can find at the deletedobject folder via adfind
-showdel and see the Last modified date - that would be when the object is
deleted.
But as for who deleted - I dont think you can find it without the auditing.
Thank you and have a splendid day!
Kind Regards,
Freddy Hartono
Group Support Engineer
InternationalSOS Pte Ltd
mail:
[EMAIL PROTECTED]
phone:
(+65) 6330-9740 - temp
From: Yann [mailto:[EMAIL PROTECTED]
Sent: Friday, October 14, 2005 2:57 PM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Knowing when users were deleted.
Hi there,
I wonder if there is a way to know when a user has been deleted from AD
other than using security audt, because at the time of the deletion, i forgot to
activate the audit :(
So my boss urge me to find the guilty user AND the time of deletion.
I looked for attributes in adsi and found that there is the whencreated,
whenmodified attribute but not whendeletedtimestamp one.
Any idea ?
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger
Téléchargez le ici !
