Who joined a computer to a domain

Question

Is there an easy way to determine what user account was used to join a computer to a domain?

Answer 1

Old post, but relevant question. The computer object will have an SID attached of which object created it. Use ADSIedit for this. Also, AD Audit Logging: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

Answer 2

Look for Event ID 645 under the security event log on the local domain controllers. The event will include a username.

You must have event auditing configured to catch these events.

More info here: http://technet.microsoft.com/en-us/library/cc787268%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc737542%28WS.10%29.aspx

Answer 3

Easy way might be to examine the logs on either the client computer that was joined to see who was logged in when the computer was joined, or the server serving as Primary Domain Controller.

If event auditing is enabled, you might also be able to see there.

Answer 4

I was looking for something similar and couldn't find a clear answer. I did found some workarounds that may help others.

by looking at NetSetup.log under windows\debug folder. Here is a small code that you can run from your computer:

$NoInfo = $null
$Offline = $null
$List = $null

#Get-Content unknowns.txt | foreach {
Get-ADComputer  -Filter 'OperatingSystem -like "*Windows server*"' -Properties * | foreach {
    $FQDN = $_.DNSHostName 
    $Path = "\\$FQDN\c`$\Windows\debug\NetSetup.log"
    if (Test-Connection $FQDN -Count 1 -ErrorAction SilentlyContinue) { 
        if (Test-Path $Path) {
            write-host "`n`nChecking $FQDN..."        
            $User = ($($(Select-String -Path $Path -Pattern "lpAccount: " -CaseSensitive)  -split " ")[3])
            $User
            [array]$List += Write-Output $FQDN";"$User

        } 
    else {[array]$NoInfo += $FQDN}
    } 
    else {[array]$Offline += $FQDN}
    #sleep 5
}
$list

Alternatively, If you have vCenter server than you can simply try below from a VMware powerCLI. The person who created the virtual machine has probably joined the computer to the domain.

In my environment the results were very accurate:

$servername = Read-host "Enter server name"
$Events = Get-VIEvent -Entity $servername -Types info -MaxSamples 999999999

    foreach ($event in $events) {
        $test = $true
        if ($event.fullFormattedMessage -match "Deploying $servername on host") {
            Write-Host ("`n$servername is created by User " + $event.username + " at: " + $event.createdTime)
            Write-Host ("`nEvent Details:`n--------------`n" + $event.fullFormattedMessage)
            $OwnerList +=  New-Object -TypeName psobject -Property @{Servername=$servername;Username=$event.username;CreationTime=$event.createdTime;EventMsg=$event.fullFormattedMessage;Estimated="No"}
            $test = $false
        }

        elseif ($event.fullFormattedMessage -like "Clone of*completed") {
            Write-Host ("`n$servername is created by User " + $event.username + " at: " + $event.createdTime)
            Write-Host ("`nEvent Details:`n--------------`n" + $event.fullFormattedMessage)
            $OwnerList +=  New-Object -TypeName psobject -Property @{Servername=$servername;Username=$event.username;CreationTime=$event.createdTime;EventMsg=$event.fullFormattedMessage;Estimated="No"}
            $test = $false
        }
        elseif ($event.fullFormattedMessage -match "Creating $servername on host") {
            Write-Host ("`n$servername is created by User " + $event.username + " at: " + $event.createdTime)
            Write-Host ("`nEvent Details:`n--------------`n" + $event.fullFormattedMessage)
            $OwnerList +=  New-Object -TypeName psobject -Property @{Servername=$servername;Username=$event.username;CreationTime=$event.createdTime;EventMsg=$event.fullFormattedMessage;Estimated="No"}
            $test = $false
        }
    }


if ($test -eq $true) {
    Write-Host "`nWarning: Unable to find the server owner" -BackgroundColor Yellow -ForegroundColor Black
    Write-Host "Note: Following entries are estimates only." -BackgroundColor Yellow -ForegroundColor Black
    Write-Host "Recommendations:"

    $lastevent = (Get-VIEvent -Entity $servername -MaxSamples 999999999 | Select-Object -last 1)
    if ($lastevent.username -ne $null -and $lastevent.username) {

        Write-Host ("`n$servername is created by User " + $lastevent.username + " at: " + $lastevent.createdTime)
        Write-Host ("`nEvent Details:`n--------------`n" + $lastevent.fullFormattedMessage)
        $OwnerList +=  New-Object -TypeName psobject -Property @{Servername=$servername;Username=$lastevent.username;CreationTime=$lastevent.createdTime;EventMsg=$lastevent.fullFormattedMessage;Estimated="Yes"}
    }

    $events = $Events | sort CreatedTime
    :loop foreach ($event in $events) { 
        $event.username
        if ($event.username -ne $null -and $event.username) {
            Write-Host ("`n$servername is created by User " + $event.username + " at: " + $event.createdTime)
            Write-Host ("`nEvent Details:`n--------------`n" + $event.fullFormattedMessage)
            $OwnerList +=  New-Object -TypeName psobject -Property @{Servername=$servername;Username=$event.username;CreationTime=$event.createdTime;EventMsg=$event.fullFormattedMessage;Estimated="Yes"}
            break loop
        }
    }
}

Output looks like this