Hi Parag, If you have audit account management enabled, you will see following event register in the security log of domain controller when the account is disabled:
Event Type: Success Audit Event Source: Security Event Category: Account Management Event ID: 629 Date: 1/3/2007 Time: 12:07:16 PM User: Domain1\admin Computer: Domain1-DC1 Description: User Account Disabled: Target Account Name: user1 Target Domain: Domain1 Target Account ID: Domain1\user1 Caller User Name: admin Caller Domain: Domain1 Caller Logon ID: (0x0,0x682B039) On 1/3/07, Parag Nagwekar <[EMAIL PROTECTED]> wrote:
Team, Is there way to find when user account was disabled in AD? Our sox auditor would like to see the list of users that accounts were disabled in last quarter plus the date when they were disabled. They will match this information with HR database. We can't rely on whenmodified attribute because helpdesk team takes a day or two to complete rest of the termination process on that account after account is disabled. -Parag
