Any thoughts on how to monitor the deletion of user accounts? I know to look for event code 630 in the security log, but this gets cumbersome across multiple domain controllers. I was thinking about trying to have the DC's log this information to a Cisco Mars box. If anyone has any info to share, it would be greatly appreciated.
Thanks Shane ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
