users removed from global group?

  • Thread starter Thread starter Chris Rhoads
  • Start date Start date
C

Chris Rhoads

Yesterday we had approximately 100 users who were removed
from a particular Global Group, but unfortunately the
security audits in Event Viewer aren't showing us exactly
which users were affected. There are a total of
approximately 5,000 users and 100 of them were affected.
When we pull up the security audits in the Event Viewer
instead of showing which users were affected, it only
shows the digital certificate information which doesn't
help us at all.

I need to know how I can find out WHICH users were
affected. I have tried using a program called Aelita
Delegation Manager, but that hasn't helped me at all. Is
there something out there that can help me accomplish my
task?

Please advise... thank you!

________________
Chris Rhoads
Application Security Administrator
(e-mail address removed)
 
Hello Chris,
Unfortunately no. If you were not auditing the proper events there will be
no way of autopsying what happened before. If you don't know which users
were affected my suggestion would be to restore thier group membership from
backup using an authoritative restore.

241594 HOW TO: Perform an Authoritative Restore to a Domain Controller in
http://support.microsoft.com/?id=241594

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top