Hi Yann,
You can find at the deletedobject folder via adfind
-showdel and see the Last modified date - that would be when the object is
deleted.
But as for who deleted - I dont think you can find it without the auditing.
Thank you and have a splendid day!
Kind Regards,
Freddy Hartono
Group Support Engineer
InternationalSOS Pte Ltd
mail:
[EMAIL PROTECTED]
phone:
(+65) 6330-9740 - temp
From: Yann [mailto:[EMAIL PROTECTED]
Sent: Friday, October 14, 2005 2:57 PM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Knowing when users were deleted.
Hi there,
I wonder if there is a way to know when a user has been deleted from AD
other than using security audt, because at the time of the deletion, i forgot to
activate the audit :(
So my boss urge me to find the guilty user AND the time of deletion.
I looked for attributes in adsi and found that there is the whencreated,
whenmodified attribute but not whendeletedtimestamp one.
Any idea ?
Appel audio GRATUIT partout dans le monde avec le nouveau Yahoo! Messenger
Téléchargez le ici !
