Modify User Account

  • Thread starter Thread starter bandwidth bandit
  • Start date Start date
B

bandwidth bandit

Can anyone tell me how to tell who it was that created a user account in
Active Directory? I know how to view when it was created but can you also
tell who created it?
 
In order to tell who created I think that you would have to have had
auditing enabled at the time of creation. You can tell what DC the account
was created on by looking at the metadata of the user object .

"repadmin /showmeta cn=testuser,cn=users,dc=domain,dc=com"

Looking at the whencreated attribute and the originating DC field will tell
you the DC that created the account.

You can then look in the DC Security logs for Account Management Events 624,
if you have Account Management Success Auditing enabled.

If auditing was not enabled at the time I am not aware of another way that
you will be able to tell.....

HTH

Jody
 
Back
Top