Usually a quick and dirty way is psloglist and eventcombmt to gather the 630's from the domain controllers.
Z Edward E. Ziots Network Engineer Lifespan Organization Email: [EMAIL PROTECTED] Phone: 401-639-3505 MCSE, MCP+I, ME, CCA, Security +, Network + -----Original Message----- From: Thomas Mullins [mailto:[EMAIL PROTECTED] Sent: Wednesday, November 05, 2008 9:39 AM To: NT System Admin Issues Subject: How to monitor deletion of user accounts Any thoughts on how to monitor the deletion of user accounts? I know to look for event code 630 in the security log, but this gets cumbersome across multiple domain controllers. I was thinking about trying to have the DC's log this information to a Cisco Mars box. If anyone has any info to share, it would be greatly appreciated. Thanks Shane ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
