Hi Parag,
If you have audit account management enabled, you will see following event
register in the security log of domain controller when the account is
disabled:
Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 629
Date: 1/3/2007
Time: 12:07:16 P
Auditing,
You are looking for the following event ID.
Event Type= Account Management
Event ID 629 (User account disabled)
Edward E. Ziots
Network Engineer
Lifespan Organization
MCSE,MCSA,MCP+I,M.E,CCA,Network+, Security +
email:[EMAIL PROTECTED]
cell:401-639-3505
arter.
Thanks
-Parag
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Ziots, Edward
Sent: Wednesday, January 03, 2007 4:56 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Disabled user + when
Auditing,
You are looking fo
ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Disabled user + when
Thanks for the quick response. I don't have logs for more than 2 days on
the DCs. They get overwritten due to size. Is there any other way? In
future I will have monitoring to detect the event and send me an email
for future
Sent: Wednesday, January 03, 2007 10:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Disabled user + when
Thanks for the quick response. I don't have logs for more than 2 days on
the DCs. They get overwritten due to size. Is there any other way? In
future I will have monitori
repadmin
/showobjmeta.
Thanks,
-Steve
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ziots, Edward
Sent: Wednesday, January 03, 2007 9:38 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Disabled user + when
Then you are going to have to restore the logs from your server
subset of the people and try to answer as best you can on the constrained set.
Wook
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Steve Linehan
Sent: Wednesday, January 03, 2007 8:02 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Disabled user + when
As Edward po
