Announcement

Collapse
No announcement yet.

User has disapeared in Active Directory

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • User has disapeared in Active Directory

    Hello All
    I have started work this morning and a strange thing has happened.
    A user has disapeared from Active Directory.
    He was logged on last night and this morning his account has just disappeared.

    Can anyone help me with this and the possible restore?
    Thanks

  • #2
    Re: User has disapeared in Active Directory

    You might perform a authoritative restore.
    Do you have backups in place?

    And are you really sure that the user has been disappeared?
    If you have enabled the auditing I would start there to see what has happened.

    Edit: For restore you might start reading from here;
    http://technet.microsoft.com/en-us/l.../cc816878.aspx
    Last edited by Dumber; 15th April 2009, 09:11.
    Marcel
    Technical Consultant
    Netherlands
    http://www.phetios.com
    http://blog.nessus.nl

    MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
    "No matter how secure, there is always the human factor."

    "Enjoy life today, tomorrow may never come."
    "If you're going through hell, keep going. ~Winston Churchill"

    Comment


    • #3
      Re: User has disapeared in Active Directory

      Check lost and found first and obviously search AD.
      If the account has truly gone then someone has deleted it. You could look at this:
      http://technet.microsoft.com/en-us/s.../bb963906.aspx

      If you have logging enabled you may be able to find out who did it too.
      cheers
      Andy

      Please read this before you post:


      Quis custodiet ipsos custodes?

      Comment


      • #4
        Re: User has disapeared in Active Directory

        Originally posted by AndyJG247 View Post
        Check lost and found first and obviously search AD.
        If the account has truly gone then someone has deleted it. You could look at this:
        http://technet.microsoft.com/en-us/s.../bb963906.aspx

        If you have logging enabled you may be able to find out who did it too.
        Hi Gents
        I used the tool that was listed in the knowledge base called adresore.net and recovered the users ID.
        I have no idea where it went and i suppose now its to late.
        I do have a full WSB but i think i will being a nightly system state backup for occasions like this.
        Thanks Gents

        Thanks
        Last edited by ZR_Seanie; 15th April 2009, 09:22.

        Comment

        Working...
        X