0

I am trying to find out what groups membership a user has had in the past in Active Directory, and who removed/added that user from those groups?

Any help would be awesome!

Improve this question
4
  • 2
    Do you have auditing enabled within Active Directory? Which level is your domain?
    – jscott
    Aug 26, 2011 at 18:18
  • 2
    Restore a backup of your DC into a VM, and look and see what it was?
    – Zoredache
    Aug 26, 2011 at 19:07
  • hello jscott and zoredache - we have audit turned on. not sure what do you mean when you say what level in domain. i am looking for more like some sort of query at the command line to get this information.
    – newbie
    Aug 26, 2011 at 19:40
  • @newbie - He means what is the Domain Functional Level of your domain.
    – MDMarra
    Aug 28, 2011 at 1:39

1 Answer 1

Reset to default
1

If you already have user auditing turned on in your domain then you should be able to search the event logs to see when members were removed from specific groups.

The following link should point you in the right direction it lists the common event id's for what you are looking for:

http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .