If a machine is removed from AD (but not properly disjoined from the domain) is a log file/entry of some kind created?
If so where would it be located and how can we access it?
If a machine is removed from AD (but not properly disjoined from the domain) is a log file/entry of some kind created?
If so where would it be located and how can we access it?
Log files, no. However, almost everything can be audited, it's a case of nailing what to turn on (try Account Management). Once enabled, audited events will appear in the DC event logs. The reality, though, is Windows auditing creates a lot of events, most of which are fairly low-level in terms of the narrative supplied with the event. However, if you perform some testing, you'll hopefully be able to pinpoint the exact auditing event(s) that you are interested in.
It sounds from your comment like you accidentally deleted the computer account from AD (the computer is still "joined" to the domain, it's account object is just gone).
If that's the case you're not in terrible shape -- if you google around you'll find lots of info on how to recover from this mistake.
If you're running Windows 2008 R2 or later you can even use the AD Recycle Bin, which is a relatively painless way to recover from this kind of mistake.
In terms of logging, anything can be audited like Simon Catlin said. You need to configure that auditing on your system though. There are a bunch of TechNet articles on this kind of thing (this one is a good starting place).
Found exactly what we were looking for in terms of auditing in case anyone else runs into this issue. It's a setting that needs to be activated in AD so the proper info will be logged. Thanks for the help everyone!!!
http://technet.microsoft.com/en-us/library/cc731764(v=ws.10).aspx
On the client machine, if you look at c:\windows\debug\netsetup.log you will see events for joining/removing a machine from a domain.