I believe event ID 645 is the creation of a user account in the domain. I use the GFI event log watcher and track that event on the network.
-----Original Message----- From: Lee Clemens [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 22, 2006 9:26 PM To: focus-ms@securityfocus.com Subject: User creation audit trail Hello all, I am trying to find a way to verify and when and by whom a user was created on a Domain computer. The account was created on the local machine, so I'm wondering if it is captured in the event log somewhere. And perhaps what the event ID is for that, or anywhere else I could find out?? Thanks in advance, Lee Clemens ------------------------------------------------------------------------ --- ------------------------------------------------------------------------ --- --------------------------------------------------------------------------- ---------------------------------------------------------------------------
