: Monday, January 19, 2004 3:02 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] How to track object deletion?
Check the lastKnownParent attribute on the deleted object.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
[EMAIL PROTECTED]
Sent: Monday
Of joe
Sent: Tuesday, January 20, 2004 2:03 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] How to track object deletion?
Hey Darren have you ever seen that attribute populated? I don't recall
ever seeing it on any objects. I never looked deeply into it though to
see what it was legally
The event viewer (when auditing is enabled) shows the following event ids
for actions mentioned
Object Event ID created Event ID modified/changed
Event ID deleted
UserID 624 ID 642 ID
630
ComputerID 645
Check the lastKnownParent attribute on the deleted object.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
[EMAIL PROTECTED]
Sent: Monday, January 19, 2004 7:37 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] How to track object deletion?
Hello, AD
I've been looking at ways for tracking static DNS record changes. So far
I've been focusing on the dnsTombestone property which has 3 values of
NULL, TRUE, and FALSE.
Perhaps you can see if that object has a similar property? I'm not at an AD
terminal now, so I can't check, but it might be
