No announcement yet.

Who created a specific user

  • Filter
  • Time
  • Show
Clear All
new posts

  • Who created a specific user


    This is my first post to any forum !

    I've a scenario. Someone created a user & now I'm trying to find out who has created this ID. When I check up in User Properties > Security tab > Advanced > Owner, it shows me only Domain Admins.

    Is there a way I can find out who (LAN ID) created this account? The Audit settings in Default Domain Controllers are:

    Policy Setting
    Audit account logon events Success, Failure
    Audit directory service access Success, Failure
    Audit logon events Success, Failure
    Audit object access Failure
    Audit policy change Success, Failure
    Audit privilege use Failure
    Audit process tracking No auditing
    Audit system events Failure

    Please guide


  • #2
    Re: Who created a specific user

    You could filter the security logs on your domain controller(s) for Event ID: 624 in Catergory: Account Management. The user who created the user object will be listed as the caller user name.

    If you need to keep the security logs for historical reasons you could archive the security logs to a data source such as SQL and then use query analyser to interegate the data, I'm not sure to what extent you would require this though.
    MCSA 2000/2003


    • #3
      Re: Who created a specific user

      If the account was created in the time since the logs were last exported or *shudder* purged, then it should be listed as 624 with the source "Security".

      Hope that helps.


      • #4
        Re: Who created a specific user

        For searching the huge size of event logs you can use Eventcomb that is the part of ALtools.

        You can download the same here:

        Kapil Sharma
        Life is too short, Enjoy It.