Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » Computer Objects
Computer Objects [message #158936] Tue, 21 July 2009 13:37 Go to next message
Gil  is currently offline Gil
Messages: 6
Registered: July 2009
Junior Member
Is there a way to determine who last made a change to a computer object?

For Example: a computer object was disabled and I am trying to research why
this hapened.

I use Vbscripts to retrieve and manipulate AD mostly.
--
Gil
Re: Computer Objects [message #158941 is a reply to message #158936] Tue, 21 July 2009 14:25 Go to previous messageGo to next message
florian  is currently offline florian  Germany
Messages: 484
Registered: July 2009
Senior Member
Howdie!

Gil schrieb:
> Is there a way to determine who last made a change to a computer object?
>
> For Example: a computer object was disabled and I am trying to research why
> this hapened.
>
> I use Vbscripts to retrieve and manipulate AD mostly.

You'd have to turn on auditing prior to get an idea who changed AD
objects. So I would be enabling auditing on the DCs.

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste
Re: Computer Objects [message #158953 is a reply to message #158936] Tue, 21 July 2009 18:38 Go to previous messageGo to next message
meiweb(nospam)  is currently offline meiweb(nospam)  Germany
Messages: 1307
Registered: July 2009
Senior Member
Hello GIL,

Enable auditing for account management on the DCs. See here about the event
ids:
http://www.ultimatewindowssecurity.com/securitylog/encyclope dia/default.aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Is there a way to determine who last made a change to a computer
> object?
>
> For Example: a computer object was disabled and I am trying to
> research why this hapened.
>
> I use Vbscripts to retrieve and manipulate AD mostly.
>
Re: Computer Objects [message #158971 is a reply to message #158936] Wed, 22 July 2009 08:31 Go to previous message
pbbergs  is currently offline pbbergs  United States
Messages: 1024
Registered: July 2009
Senior Member
You need to understand the different types of objects and how they can be
audited. Most books out on the o/s usually have a good chapter on this. Be
careful to not just use a shotgun approach and audit everything, this will
give you information overload and trying to track specific issues you are
looking to monitor almost impossible.

There are 9 seperate Audit Policies:
Account Logon Events
Account Management
Directory Service Access
Logon Events
Object Access
Policy Change
Privlege Use
Process Tracking
System Event

http://technet.microsoft.com/en-us/library/cc766468(WS.10).aspx

http://support.microsoft.com/kb/814595

http://www.windowsecurity.com/articles/Windows-Active-Direct ory-Auditing.html

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"Gil" <Gil@discussions.microsoft.com> wrote in message
news:CCB2F47C-1537-4D61-BBC6-C063F857C168@microsoft.com...
> Is there a way to determine who last made a change to a computer object?
>
> For Example: a computer object was disabled and I am trying to research
> why
> this hapened.
>
> I use Vbscripts to retrieve and manipulate AD mostly.
> --
> Gil
Previous Topic:Same file permissions for every users in the same domain
Next Topic:help me please
Goto Forum:
  


Current Time: Wed Oct 18 01:45:16 EDT 2017

Total time taken to generate the page: 0.03648 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software