How can I find last logon information in Active Directory of a user that has been deleted?
migrated from security.stackexchange.com Aug 20 '13 at 15:36
This question came from our site for Information security professionals.
In case of AD 2003, once you delete the user object, most of the properties get removed from the user object and its SID information is stored in Deleted Items folder. There if you undelete this user, you will get object restored but rest properties you will need to set manually. Another option is you can restore your system state, mark the delete user as authoritative and restore complete user object to know more information about this user object. Once you get the information, again you can delete this user.
At this moment, In your case, I see only one option as restore same user object from backups and find this information.