Re: [ActiveDir] User account deletion

[Matt Hargraves]

Just an FYI, this event will only be on the DC that the user was connected to when they deleted the account, it won't show up on all DCs, so this could be a relatively daunting task, mattering on your environment (or impossible, if your event logs roll over frequently and you don't save them off to another server or have software that saves them)

On 10/6/06, Matt Hargraves <[EMAIL PROTECTED]> wrote:

>From Microsoft's website:

   Event ID: 630
       Type: Success Audit
Description: User Account Deleted:
             Target Account Name: %1    Target Domain: %2
             Target Account ID: %3      Caller User Name: %4


             Caller Domain: %5          Caller Logon ID: %6
             Privileges: %7

Check the security logs on your DCs for 630 events.

On 10/6/06, Almeida Pinto, Jorge de <[EMAIL PROTECTED]> wrote:

by, you really cannot find it anymore when querying AD 
;-)
 
jorge



  

  

  From: [EMAIL PROTECTED] 
  [mailto:[EMAIL PROTECTED]] On Behalf Of Chris 
  Pohlschneider
Sent: Friday, October 06, 2006 14:34
To: 
  ActiveDir@mail.activedir.org
Subject: [ActiveDir] User account 
  deletion


  

  

  
Is there a way to tell if a user 
  account has been deleted?
  
 
  
 
  
 
  
Thanks,
  
 
  
 
  
Chris



This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.