@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
Collecting metadata may be more illuminating. You should be able to reconstruct
at least some part of the changes to the object by looking at various
attributes.
Piece of cake with repadmin /showobjmeta
From
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
Bob,
Just had to use this again to find a service account whose password was
changed. They do have change control and they are using a product named Change
Auditor BUT this product
If auditing of that is enabled, not sure what the default is... .yes.
Event ID 4725 for user accounts in 2008. On 2003 it was 629.
Christopher Bodnar
Enterprise Architect I, Corporate Office of Technology:Enterprise
Architecture and Engineering Services
Tel 610-807-6459
3900 Burgess
of Christopher Bodnar christopher_bod...@glic.com
Sent: Thursday, February 20, 2014 11:55 AM
To: ntsysadm@lists.myitforum.com
Subject: Re: [NTSysADM] who and when an AD user account disabled
If auditing of that is enabled, not sure what the default is... .yes. Event ID
4725 for user accounts in 2008
christopher_bod...@glic.com
The Guardian Life Insurance Company of America
www.guardianlife.com
From: Christopher Bodnar christopher_bod...@glic.com
To: ntsysadm@lists.myitforum.com
Date: 02/20/2014 01:05 PM
Subject:RE: [NTSysADM] who and when an AD user account disabled
Of Michael B. Smith
Sent: Thursday, February 20, 2014 10:07 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
You can look at WhenChanged on the object to see the last time it was changed.
Of course, if it has been enabled or otherwise touched
[mailto:listsad...@lists.myitforum.com] On
Behalf Of Michael B. Smith
Sent: Thursday, February 20, 2014 10:07 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
You can look at WhenChanged on the object to see the last time it was changed
20, 2014 9:58 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
Their Security event log has already wrapped in the last 4 hours so I doubt I
will be able to go back to December when they think the account was
mysteriously disabled
[mailto:listsad...@lists.myitforum.com] On
Behalf Of Aakash Shah
Sent: Friday, 21 February 2014 6:23 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
Probably a long shot, but any chance that they have backups of their DCs from
December? It’s
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
Surely someone raised an ticket or service request in some system somewhere?
That would give you a starting point for isolating the date/time. And then
whoever closed the ticket as being completed
).
Cheers
Ken
From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On
Behalf Of Jon Harris
Sent: Friday, 21 February 2014 11:32 AM
To: ntsysadm@lists.myitforum.com
Subject: RE: [NTSysADM] who and when an AD user account disabled
Sounds like they need to add to your work
11 matches
Mail list logo
