Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering if there is anyone that I can find out who did update on a user account in AD without going through event logs?

Something like a batch file or vbs should be ok.

share|improve this question
The only place that's stored is in the event logs. Nothing stopping a batch or vbscript from digging through the logs for you, though.. – Shane Madden Nov 23 '11 at 20:38
up vote 7 down vote accepted

The Security Event Log on the domain controller where the modification occurred would be the place to find the information you're looking for but, unfortunately, there isn't enough auditing enabled by default to give you the information you're looking for. In an after-the-fact scenario like this you're probably out of luck if you didn't already have auditing enabled. For the future consider enabling auditing for the types of events that interest you.

If you do have the right auditing enabled then you might consider exporting the event log to an XML or text format and rifling through it, at least initially, with something simple like findstr to pinpoint entries that need to be examined. Be aware that you need to examine the Security Event Log on each Domain Controller (DC) since the modification could have been made on any DC and would only be logged on the DC where the modification occurred.

share|improve this answer
On a 2008 DC at least, the User Account Management events should be logged by default - but with 2003 DCs in the environment, then having it logged may be hit or miss. – Shane Madden Nov 23 '11 at 21:08
@ShaneMadden: I saw the "windows-server-2003" and, rightly or wrongly, assumed that there's likely an old W2K3 AD domain w/ a "Default Domain Controllers Policy" and "Default Domain Policy" from W2K3. – Evan Anderson Nov 23 '11 at 21:35
Yup - probably rightly. – Shane Madden Nov 23 '11 at 21:44
isnt there any other way without using security logs? – ikel Nov 29 '11 at 3:16
Not in a "supported" fashion. If you weren't using circular logging for the ESE instance backing AD and you could find details of the contents of the transaction log files you might have a shot there, but circular logging is the default and, to my knowledge, the low-level details of the transaction log files aren't published. – Evan Anderson Nov 29 '11 at 3:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.