[NTSysADM] who and when an AD user account disabled

[Webster]

Is it possible, using PoSH or another utility, to find out who disabled a 
user's account and when it happened?  All DCs are 2008 R2 and DFL/FFL are both 
2008 R2.


Thanks



Webster

?