Recovering a Deleted Computer Object?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello Ladies & Gents,

I have notebook user who has come into the office today and attempted to
connect to the network, however there computer profile has been removed from
active directory, i suspect that it has been accidentaly removed by one of my
admins, is there any way of retieving this and assertaining who it was that
deleted the object and when it was removed?

Cheers, Rob
 
If you have a recent backup you can recover the computer account using the
'restore subtree' restore option of ntdsutil. As for finding the culprit,
this will depend on the auditing levels you have set, do you know what these
are?
 
To recover the object, you need to do a system state restore of the object.
To determine who and when, you must have had auditing enabled prior to the
deletion.
 
Thanks for the response guys, this is much appreciated, i do have backup and
i will use them to restore the computer, just wasnt sure if there was an
easier way.

As for the auditin we didnt have it enabled on the system, would one of you
mind giving me some advice on how this is done?

Cheers, Rob
 
Back
Top