dreamworx said:
Can anyone tell me if i could find any kind of log on a win 2003
machine to whom would of installed dcpromo??? someone who works for me
is getting sacked as this has been installed in error and im sure this
person wouldnt even know how to do it, HELP
That might have been something if you had Account Management
Auditing or something like enable BEFORE the DCPromo but
think about this:
To DCPromo a Server you must be an Admin of that server.
(Should limit the suspects).
To DCPromo a Server into an existing domain, you must be
an admin of the Server AND the Domain. (This should limit
the suspects even further.)
Calm down (or act calm <grin>) and send out a note that you
are getting ready to destroy this DC unless someone can log
onto it with the Local Admin password -- maybe the culprit
will volunteer the DCPromo required password <evil grin>
BTW, you might check ownership of the upgraded files (like
the MMC) if they don't show the expected Admin account
maybe that is who did it. (Not sure that this won't just show
the built-in Admin account though)
