Event ID 633 (Global Group) or 637 (Local Group) in the Security event log will identify a user being removed from a group and by whom.
Mike Thommes ________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Thursday, April 10, 2008 9:53 AM To: Active Directory Admin Issues Subject: Tracking Admin Changes ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ ~ ~ ~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~ ~ <http://www.sunbelt-software.com/product.cfm?id=400> ~
