Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there an easy way to determine what user account was used to join a computer to a domain?

share|improve this question

3 Answers 3

Look for Event ID 645 under the security event log on the local domain controllers. The event will include a username.

You must have event auditing configured to catch these events.

More info here: http://technet.microsoft.com/en-us/library/cc787268%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc737542%28WS.10%29.aspx

share|improve this answer

Old post, but relevant question. The computer object will have an SID attached of which object created it. Use ADSIedit for this. Also, AD Audit Logging: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

share|improve this answer

Easy way might be to examine the logs on either the client computer that was joined to see who was logged in when the computer was joined, or the server serving as Primary Domain Controller.

If event auditing is enabled, you might also be able to see there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.