0

I am trying to find out what groups membership a user has had in the past in Active Directory, and who removed/added that user from those groups?

Any help would be awesome!

  • 2
    Do you have auditing enabled within Active Directory? Which level is your domain? – jscott Aug 26 '11 at 18:18
  • 2
    Restore a backup of your DC into a VM, and look and see what it was? – Zoredache Aug 26 '11 at 19:07
  • hello jscott and zoredache - we have audit turned on. not sure what do you mean when you say what level in domain. i am looking for more like some sort of query at the command line to get this information. – newbie Aug 26 '11 at 19:40
  • @newbie - He means what is the Domain Functional Level of your domain. – MDMarra Aug 28 '11 at 1:39
1

If you already have user auditing turned on in your domain then you should be able to search the event logs to see when members were removed from specific groups.

The following link should point you in the right direction it lists the common event id's for what you are looking for:

http://www.windowsecurity.com/articles/Auditing-Users-Groups-Windows-Security-Log.html

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.