Home / server / Questions / 1036136
Accepted
Rowan Hawkins
Asked: 2020-10-03 04:35:03 +0800 CST

How to tell what user or process created or disabled an AD user or group?

  • 772

From Windows Active Directory Users and Groups. I can see when a user or group was modified. From System Internals I can also see when it was created. Is there a way to tell what User created the object or what user or process actually disabled it?

In this particular case it was created over a year ago, and last modified a few weeks ago.

active-directory user-management

1 Answers

  1. Best Answer

    You need to enable audit logging in the security settings and scan for events

    The Subject* keys tell you the account that requested the change.

    There are some more event logs you should watch, I'm not going to list them here. You'll find a comprehensive list here:

    • 0