Who joined a computer to a domain

Question

Is there an easy way to determine what user account was used to join a computer to a domain?

Answer 1

Look for Event ID 645 under the security event log on the local domain controllers. The event will include a username.

You must have event auditing configured to catch these events.

More info here: http://technet.microsoft.com/en-us/library/cc787268%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc737542%28WS.10%29.aspx

Answer 2

Easy way might be to examine the logs on either the client computer that was joined to see who was logged in when the computer was joined, or the server serving as Primary Domain Controller.

If event auditing is enabled, you might also be able to see there.