in-line:
Mitch Reid wrote:
We had a few user accounts that were deleted and then recreated and
nobody will take responsibility.
I used ADSIedit to verify the creation date/time.
While auditing is enabled, the Security log rolled and we missed the
event (yes I know it's an issue).
Assuming you backup the server, specifically the event logs, you can
restore the security event log from around the time of the creation.
Is there a way to see who created the the user object?
Once you find the events (624) you will find who (Caller User Name)
created it.
hth,
john
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir@mail.activedir.org/
