Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to find out what groups membership a user has had in the past in Active Directory, and who removed/added that user from those groups?

Any help would be awesome!

share|improve this question
2  
Do you have auditing enabled within Active Directory? Which level is your domain? –  jscott Aug 26 '11 at 18:18
2  
Restore a backup of your DC into a VM, and look and see what it was? –  Zoredache Aug 26 '11 at 19:07
    
hello jscott and zoredache - we have audit turned on. not sure what do you mean when you say what level in domain. i am looking for more like some sort of query at the command line to get this information. –  newbie Aug 26 '11 at 19:40
    
@newbie - He means what is the Domain Functional Level of your domain. –  MDMarra Aug 28 '11 at 1:39
add comment

1 Answer

If you already have user auditing turned on in your domain then you should be able to search the event logs to see when members were removed from specific groups.

The following link should point you in the right direction it lists the common event id's for what you are looking for:

http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.