http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4725
Get-Event From: [email protected] [mailto:[email protected]] On Behalf Of Webster Sent: Thursday, February 20, 2014 12:43 PM To: [email protected] Subject: [NTSysADM] who and when an AD user account disabled Is it possible, using PoSH or another utility, to find out who disabled a user's account and when it happened? All DCs are 2008 R2 and DFL/FFL are both 2008 R2. Thanks Webster
