I may have missed the post regarding this option but since I don't see it; have you reviewed the "mS-DS-CreatorSID" property. It's an optional attribute per computer account. Each time a user adds a computer by utilizing a specific privilege within AD, a query is executed by the DC against all machine accounts in the domain to determine if the user has exceeded the imposed quota, if not, the account is created and this attribute is populated. It would seem that this may provide an alternative means of identifying some of what you're after. The following steps may prove useful -
1. Start ADSIEdit 2. Expand Domain NC 3. Locate the computer account that you're looking for 4. Right click on the account and select Properties 5. In the Select a Property to View box, select the "mS-DS-CreatorSID" property If there is no value then someone with sufficient administrative privileges in the domain created the account. If the property has a value then you know that someone used the special privileges granted to authenticated users to create this account. -- Dean Wells MSEtechnology * Email: [EMAIL PROTECTED] http://msetechnology.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thommes, Michael M. Sent: Friday, July 22, 2005 12:31 PM To: [email protected] Subject: [ActiveDir] How to find creator of computer account? Is there any way to find the creator of a computer account other than looking at the security log events written to the DCs when the computer join takes place? With ADSIEdit I can see the creation date of the account, but no information on the creator name or SID. Maybe it is buried in there and I just can't see it? TIA! Mike Thommes List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
