Turn up auditing and then parse the Security event logs on your domain controllers. There are a variety of ways to partially or fully automate this, including EventComb and scripting.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Nigel Glasgow Sent: Friday, January 13, 2006 8:47 AM To: [email protected] Subject: [ActiveDir] Find date Computer object was deleted and created Hi all, I am trying to determine if and when a Sysadmin with domain admin pass deleted and recreated a computer object in the domain. This info will useful to any IT manager or SysAdmin who is having doubts about what is being reported when computer objects are suddenly absent, then they reappear in the domain computer listing next day. Any help out there? Thanks. List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
