Announcement

Collapse
No announcement yet.

See who made changes to AD (Was: Pl. advice)

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • See who made changes to AD (Was: Pl. advice)

    Suppose We have ten AD admins in a domain , one of the AD admin had make a mistake , he had deleted the OU & which replicated to all the domain controllers in domain. Pl. advice me How can we find out that who had done the disaster ?

  • #2
    Re: Pl. advice

    Is auditing enabled?
    If not, I think you are out of luck

    PS -- please choose a better title for your post next time
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    PhD, MSc, FIAP, MIITT
    IT Trainer / Consultant
    Ossian Ltd
    Scotland

    ** Remember to give credit where credit is due and leave reputation points where appropriate **

    Comment


    • #3
      Re: See who made changes to AD (Was: Pl. advice)

      how can I enable the auditing ?

      Comment


      • #4
        Re: Pl. advice

        You are kidding, right? -- a network admin who doesnt know how to use a basic tool like auditing?

        Group Policy
        Open default domain controller policy
        Computer -- Windows Settings -- Security Settings -- Local Policies -- Audit Policy

        You may also need to turn auditing on at the object level -- see here for more info:
        http://www.windowsecurity.com/articl...-Auditing.html
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment


        • #5
          Re: See who made changes to AD (Was: Pl. advice)

          Also - you need to be aware that turning on auditing now, if it's not already turned on, is NOT going to help you this time

          It'll help in future.
          Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

          Comment


          • #6
            Re: See who made changes to AD (Was: Pl. advice)

            sir ,
            accounting was enabled , sorry for responding very late .

            Comment

            Working...
            X