Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there an easy way to determine what user account was used to join a computer to a domain?

share|improve this question

Old post, but relevant question. The computer object will have an SID attached of which object created it. Use ADSIedit for this. Also, AD Audit Logging:

share|improve this answer

Look for Event ID 645 under the security event log on the local domain controllers. The event will include a username.

You must have event auditing configured to catch these events.

More info here:

share|improve this answer

Easy way might be to examine the logs on either the client computer that was joined to see who was logged in when the computer was joined, or the server serving as Primary Domain Controller.

If event auditing is enabled, you might also be able to see there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.