2

Is there a way to find out when user was added to distribution group and by who? Probably thru AD or Exchange Management Console? Or such information is not stored anywhere?

1 Answer 1

4

If you have Directory Service Change auditing enabled, there would be a 5136 event in the security event log on the domain controller where the change was made.

You can also identify when the member attribute was last changed. If the dl does not change often, this may help if the last change was when that account was added to the dl.

repadmin /showobjmeta <dcname> "<dn of distribution list>"  

results:

29 entries.
Loc.USN                           Originating DSA  Org.USN  Org.Time/Date        Ver Attribute
=======                           =============== ========= =============        === =========
 409215      1b022a66-0f20-440d-b6f6-9a9b3b83b83c  36538059 2006-01-24 16:04:24    1 objectClass  
 409215      90864325-7d94-48ef-b941-9a1595ce749c 103330135 2008-06-02 09:22:57   22 member  

Audit Directory Service Changes
http://technet.microsoft.com/en-us/library/dd772641%28v=ws.10%29.aspx

1
  • The repadmin helped a lot. For each member it showed: PRESENT member 2012-06-22 13:30:49 Domain\AD2 (deleted DSA) 20181 21139211 1 ...OBJECT... In Windows 2012 the ID's were 4761, 4760.
    – MadBoy
    Jan 20, 2013 at 16:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .