Announcement

Collapse
No announcement yet.

Auditing OU creation / deletion

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Auditing OU creation / deletion

    Hello All,

    I would like to know the steps and procedures to know who has created / deleted the OU on my windows 2003 Additional domain controller.

    Cheers
    Scientist.

  • #2
    Re: Auditing OU creation / deletion

    You need to enable auditing on the OU.

    You will not be able to tell who created or deleted unless you have this enabled so it only works from the time you enabled it and cannot be used to check events that have occured.

    http://www.windowsecurity.com/articl...urity-Log.html

    Comment


    • #3
      Re: Auditing OU creation / deletion

      Thanks a lot for the reply wullieb1 I have enabled it on my test bed setup and couldn't really come accross the event id 566 that speaks about the OU creation / deletion. I also wonder if the event ID reveals the actual domain ID from whom the changes have happened. Need your expertise understanding the stuff more. Thank you!!!

      Cheers
      Scientist.

      Comment

      Working...
      X