Is there a way to find out when user was added to distribution group and by who? Probably thru AD or Exchange Management Console? Or such information is not stored anywhere?
1 Answer
If you have Directory Service Change auditing enabled, there would be a 5136 event in the security event log on the domain controller where the change was made.
You can also identify when the member attribute was last changed. If the dl does not change often, this may help if the last change was when that account was added to the dl.
repadmin /showobjmeta <dcname> "<dn of distribution list>"
results:
29 entries.
Loc.USN Originating DSA Org.USN Org.Time/Date Ver Attribute
======= =============== ========= ============= === =========
409215 1b022a66-0f20-440d-b6f6-9a9b3b83b83c 36538059 2006-01-24 16:04:24 1 objectClass
409215 90864325-7d94-48ef-b941-9a1595ce749c 103330135 2008-06-02 09:22:57 22 member
Audit Directory Service Changes
http://technet.microsoft.com/en-us/library/dd772641%28v=ws.10%29.aspx
-
The repadmin helped a lot. For each member it showed: PRESENT member 2012-06-22 13:30:49 Domain\AD2 (deleted DSA) 20181 21139211 1 ...OBJECT... In Windows 2012 the ID's were 4761, 4760.– MadBoyJan 20, 2013 at 16:43