Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've turned on Audit Account Management to monitor for deletion of user accounts from Active Directory. Can I view these events in the Security log on the domain controller? We have two domain controllers - will the event be in both logs, or will I need to check both machines? What Category should I be looking for?

I ask because I have a recurring problem where a SharePoint list stops receiving email. This is because some user/process/gremlin is deleting the email alias account in Active Directory every so often. This has just happened again and I would like to see the event recorded in a log so I can identify the user/process/gremlin.

Edit
This is a Contact, not a User. I don't know if that makes a difference...

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Security events show up in the Log of the DC that was used to process the request, so which ever DC was used to verify the accounts privilages. So you will need to check both DC's.

You can use the free Event Comb tool, included in the server 2003 resource kit, this can gather specific events from multiple computers and display them in one place.

share|improve this answer
    
I never tracked this bug down, but I did learn a lot using the Event Comb tool. –  Nathan DeWitt Mar 13 '11 at 5:21

You'll need to check both. You are looking for event ID 630 in the category Account Management. Here's the reference as to the format of the event record, in case you are parsing this automatically via a script:

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=630

share|improve this answer
    
If it's a Contact instead of a User, would it have a different error code? –  Nathan DeWitt Jun 1 '09 at 13:34
    
I'm not sure and don't have a ready means of testing at the moment. But it would be a simple matter to test. –  K. Brian Kelley Jun 1 '09 at 14:31
    
Basically, I am not finding a 630 event ID in either log. How would I find out what event I should be looking for? I'm a newbie when it comes to querying Active Directory events. –  Nathan DeWitt Jun 1 '09 at 14:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.