Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If a machine is removed from AD (but not properly disjoined from the domain) is a log file/entry of some kind created?

If so where would it be located and how can we access it?

share|improve this question
    
I looked in there and we didn't find what we were looking for. What happened is this object was accidentally deleted from AD but is still a member if the domain. The machine hasn't been completely/properly removed. On a side note I'm still fairly new to ServerFault and the other accompanying sites and I'm unsure of the etiquette and rules. I wanted to repose the question because I didn't ask it properly the first time around. What would have been the best way to go about this? –  Ross Lordon Sep 7 '12 at 19:19
1  
Generally you should update your question unless your adjustments are substantially different. –  Zoredache Sep 7 '12 at 20:09
add comment

4 Answers

Log files, no. However, almost everything can be audited, it's a case of nailing what to turn on (try Account Management). Once enabled, audited events will appear in the DC event logs. The reality, though, is Windows auditing creates a lot of events, most of which are fairly low-level in terms of the narrative supplied with the event. However, if you perform some testing, you'll hopefully be able to pinpoint the exact auditing event(s) that you are interested in.

share|improve this answer
add comment

It sounds from your comment like you accidentally deleted the computer account from AD (the computer is still "joined" to the domain, it's account object is just gone).

If that's the case you're not in terrible shape -- if you google around you'll find lots of info on how to recover from this mistake.

If you're running Windows 2008 R2 or later you can even use the AD Recycle Bin, which is a relatively painless way to recover from this kind of mistake.


In terms of logging, anything can be audited like Simon Catlin said. You need to configure that auditing on your system though. There are a bunch of TechNet articles on this kind of thing (this one is a good starting place).

share|improve this answer
add comment

On the client machine, if you look at c:\windows\debug\netsetup.log you will see events for joining/removing a machine from a domain.

share|improve this answer
add comment
up vote 0 down vote accepted

Found exactly what we were looking for in terms of auditing in case anyone else runs into this issue. It's a setting that needs to be activated in AD so the proper info will be logged. Thanks for the help everyone!!!

http://technet.microsoft.com/en-us/library/cc731764(v=ws.10).aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.