You might wanna take a look at: http://blogs.dirteam.com/blogs/jorge/archive/2005/11/24/161.aspx Cheers, jorge
________________________________ From: [EMAIL PROTECTED] on behalf of Kamlesh Parmar Sent: Thu 11/24/2005 8:39 PM To: [email protected] Subject: [ActiveDir] Find originating DC for password change How do I find out, on which DC password for a particular user was changed or reset. I know, if account management auditing is enabled, I will get a event 627 or 628. But what if I have large number of DCs? and I don't have monitoring app like MOM ? Last I checked, I was not able to see any metadata info for password using repadmin Which is the first command I run for finding the originating DC for any change. I use following command repadmin /showobjmeta DCNAME UserDN -- Kamlesh ~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Be the change you want to see in the World" ~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
<<winmail.dat>>
