I've turned on Audit Account Management to monitor for deletion of user accounts from Active Directory. Can I view these events in the Security log on the domain controller? We have two domain controllers - will the event be in both logs, or will I need to check both machines? What Category should I be looking for?
I ask because I have a recurring problem where a SharePoint list stops receiving email. This is because some user/process/gremlin is deleting the email alias account in Active Directory every so often. This has just happened again and I would like to see the event recorded in a log so I can identify the user/process/gremlin.
This is a Contact, not a User. I don't know if that makes a difference...