Mitch Reid wrote:
We had a few user accounts that were deleted and then recreated and nobody will take responsibility.
I used ADSIedit to verify the creation date/time.
While auditing is enabled, the Security log rolled and we missed the event (yes I know it's an issue).

Assuming you backup the server, specifically the event logs, you can restore the security event log from around the time of the creation.

Is there a way to see who created the the user object?

Once you find the events (624) you will find who (Caller User Name) created it.


List info   :
List FAQ    :
List archive:

Reply via email to