3

If a machine is removed from AD (but not properly disjoined from the domain) is a log file/entry of some kind created?

If so where would it be located and how can we access it?

2
  • I looked in there and we didn't find what we were looking for. What happened is this object was accidentally deleted from AD but is still a member if the domain. The machine hasn't been completely/properly removed. On a side note I'm still fairly new to ServerFault and the other accompanying sites and I'm unsure of the etiquette and rules. I wanted to repose the question because I didn't ask it properly the first time around. What would have been the best way to go about this? Sep 7, 2012 at 19:19
  • 1
    Generally you should update your question unless your adjustments are substantially different.
    – Zoredache
    Sep 7, 2012 at 20:09

4 Answers 4

2

Log files, no. However, almost everything can be audited, it's a case of nailing what to turn on (try Account Management). Once enabled, audited events will appear in the DC event logs. The reality, though, is Windows auditing creates a lot of events, most of which are fairly low-level in terms of the narrative supplied with the event. However, if you perform some testing, you'll hopefully be able to pinpoint the exact auditing event(s) that you are interested in.

1

It sounds from your comment like you accidentally deleted the computer account from AD (the computer is still "joined" to the domain, it's account object is just gone).

If that's the case you're not in terrible shape -- if you google around you'll find lots of info on how to recover from this mistake.

If you're running Windows 2008 R2 or later you can even use the AD Recycle Bin, which is a relatively painless way to recover from this kind of mistake.


In terms of logging, anything can be audited like Simon Catlin said. You need to configure that auditing on your system though. There are a bunch of TechNet articles on this kind of thing (this one is a good starting place).

1

Found exactly what we were looking for in terms of auditing in case anyone else runs into this issue. It's a setting that needs to be activated in AD so the proper info will be logged. Thanks for the help everyone!!!

http://technet.microsoft.com/en-us/library/cc731764(v=ws.10).aspx

0

On the client machine, if you look at c:\windows\debug\netsetup.log you will see events for joining/removing a machine from a domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .