From Windows Active Directory Users and Groups. I can see when a user or group was modified. From System Internals I can also see when it was created. Is there a way to tell what User created the object or what user or process actually disabled it?
In this particular case it was created over a year ago, and last modified a few weeks ago.