Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » Computer Account Deleted Automatically
Computer Account Deleted Automatically [message #160188] Thu, 20 August 2009 01:40 Go to next message
saqib ahmad  is currently offline saqib ahmad
Messages: 49
Registered: August 2009
Member
Dear,

My one Computer Account Deleted Automatically from active directory, when i
tried to loging it gives me the msg that no computer account found on
database of server.

Please tell me how to check that how did that account deleted what should be
the precautions to be taken for future to prevent it.

Thanks

Saqib
Re: Computer Account Deleted Automatically [message #160189 is a reply to message #160188] Thu, 20 August 2009 01:48 Go to previous messageGo to next message
meiweb(nospam)  is currently offline meiweb(nospam)  Germany
Messages: 1307
Registered: July 2009
Senior Member
Hello saqib,

Accounts wan't delete themself in AD, also AD didn't remove them automatic.
To find the account that has deleted it you have to enable auditing on the
domain controllers OU with GPO.

Under computer configuration, windows settings, security settings, local
policies, audit policy enable "Audit account management" for success and
failure.

Here you will have a good overview over event id's that are logged:
http://www.ultimatewindowssecurity.com/securitylog/encyclope dia/default.aspx

Choose "Account mamagement" and you will see event id 647 for 2000/2003 and
4743 2008 for "Computer account deleted"

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Dear,
>
> My one Computer Account Deleted Automatically from active directory,
> when i tried to loging it gives me the msg that no computer account
> found on database of server.
>
> Please tell me how to check that how did that account deleted what
> should be the precautions to be taken for future to prevent it.
>
> Thanks
>
> Saqib
>
Re: Computer Account Deleted Automatically [message #160190 is a reply to message #160188] Thu, 20 August 2009 01:52 Go to previous messageGo to next message
meiweb(nospam)  is currently offline meiweb(nospam)  Germany
Messages: 1307
Registered: July 2009
Senior Member
Hello saqib,

Please post also the complete error message you get. Maybe there exist some
problem related to AD. How many DCs do you have in the domain and how are
they located?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Dear,
>
> My one Computer Account Deleted Automatically from active directory,
> when i tried to loging it gives me the msg that no computer account
> found on database of server.
>
> Please tell me how to check that how did that account deleted what
> should be the precautions to be taken for future to prevent it.
>
> Thanks
>
> Saqib
>
Re: Computer Account Deleted Automatically [message #160192 is a reply to message #160188] Thu, 20 August 2009 01:54 Go to previous messageGo to next message
Syed Khairuddin  is currently offline Syed Khairuddin  Saudi Arabia
Messages: 77
Registered: June 2009
Member
Weird it should not be deleteled autmatically if its in use.
Did u happened to check it in the ADUC ?? what is the exact error you
are receiving ?
Re: Computer Account Deleted Automatically [message #160199 is a reply to message #160192] Thu, 20 August 2009 03:29 Go to previous messageGo to next message
saqib ahmad  is currently offline saqib ahmad
Messages: 49
Registered: August 2009
Member
Dear All,

Yes iam also really concerned about it as i have migrated our old dc from
windows server 2000 to windows server 2008 last 15 days back and the machine
wich was unable to be loging was also new and I installed windows server 2008
Ent around 10 days back and our applications were running on it properlly i
just install a backup software on it it required the restart then I failed to
login the machine the coz it production invironment and my applications were
down I rejoined it to domain by going on to workgroup through local admin
account then again joined the domain and turned on all the applications on
it, but its really critical for me as it wont happing to any other machine in
my network I want to ensure that my AD is fine , further iam also working
with AD invornment since long but i never seen computer account vanishining
like this then i also checked that the DNS A record is also present in it.

Any suggestions???


"Syed Khairuddin" wrote:

> Weird it should not be deleteled autmatically if its in use.
> Did u happened to check it in the ADUC ?? what is the exact error you
> are receiving ?
>
>
>
Re: Computer Account Deleted Automatically [message #160201 is a reply to message #160199] Thu, 20 August 2009 03:39 Go to previous messageGo to next message
meiweb(nospam)  is currently offline meiweb(nospam)  Germany
Messages: 1307
Registered: July 2009
Senior Member
Hello saqib,

Chekc your DCs with dcdiag /v, netdiag and repadmin /showrepl to check for
existing errors.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Dear All,
>
> Yes iam also really concerned about it as i have migrated our old dc
> from windows server 2000 to windows server 2008 last 15 days back and
> the machine wich was unable to be loging was also new and I installed
> windows server 2008 Ent around 10 days back and our applications were
> running on it properlly i just install a backup software on it it
> required the restart then I failed to login the machine the coz it
> production invironment and my applications were down I rejoined it to
> domain by going on to workgroup through local admin account then again
> joined the domain and turned on all the applications on it, but its
> really critical for me as it wont happing to any other machine in my
> network I want to ensure that my AD is fine , further iam also working
> with AD invornment since long but i never seen computer account
> vanishining like this then i also checked that the DNS A record is
> also present in it.
>
> Any suggestions???
>
> "Syed Khairuddin" wrote:
>
>> Weird it should not be deleteled autmatically if its in use.
>> Did u happened to check it in the ADUC ?? what is the exact error you
>> are receiving ?
Re: Computer Account Deleted Automatically [message #361238 is a reply to message #160188] Wed, 06 January 2010 14:51 Go to previous messageGo to next message
Haynsey  is currently offline Haynsey  United States
Messages: 2
Registered: January 2010
Junior Member
G'day,

Sorry for jumping into this thread with my own problem albeit very
similar to the OP's so I hope I can add something to it. If someone has
an issue I will create a new thread no worries.

We run a single 2003 native domain with 6 DC's. All clients are XP SP2.
I inherited this domain so I cannot speculate on how its initial setup
was done.

The issue we are experiencing is that random workstation accounts are
being deleted from AD and we don't know why. It occurs roughly once a
fortnight, it has not affected a server account yet and I believe it is
only occuring on computer accounts that are sitting inside one of AD's
OU's (We have multiple sites so depending on their site, computers are
organized into a particular OU) but I will need to confirm this with my
counterparts.

When the account is deleted, the workstation is not able to be used on
the domain. On logon, it says that the domian is unnavailable or the
account was deleted. Checking inside AD, you can verify the account no
longer exists.

I have enabled auditing on all 6 DC's. When the account is deleted, I
go through and check the last 24 hours but there is no mention of event
ID 647. I have also checked scheduled tasks that other admin's may have
enabled are there is nothing I found running against AD. I would assume
if a script was deleting these accounts, event ID 647 would pop up.

Google is not being cooperative either.

I will be running dcdiag on all DC's throughout the day user requests
permitting.

Is there another way I can find out how these accounts are being
deleted?
Is there something I'm missing?

Any thoughts?

Any help would be greatly appreciated.

Matt


--
Haynsey
------------------------------------------------------------ ------------
Haynsey's Profile: http://forums.techarena.in/members/171451.htm
View this thread: http://forums.techarena.in/active-directory/1234404.htm

http://forums.techarena.in
Re: Computer Account Deleted Automatically [message #361239 is a reply to message #361238] Wed, 06 January 2010 15:26 Go to previous message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello Haynsey,

As this posting is already from 08/2009 it is always better to create a new
one. Anyway, as stated in the beginning for the OP, a computer account will
NOT be deleted automatically, except some scripts are trigger this.

What auditing settings in detail have you set on the domain controllers OU?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> G'day,
>
> Sorry for jumping into this thread with my own problem albeit very
> similar to the OP's so I hope I can add something to it. If someone
> has an issue I will create a new thread no worries.
>
> We run a single 2003 native domain with 6 DC's. All clients are XP
> SP2. I inherited this domain so I cannot speculate on how its initial
> setup was done.
>
> The issue we are experiencing is that random workstation accounts are
> being deleted from AD and we don't know why. It occurs roughly once a
> fortnight, it has not affected a server account yet and I believe it
> is only occuring on computer accounts that are sitting inside one of
> AD's OU's (We have multiple sites so depending on their site,
> computers are organized into a particular OU) but I will need to
> confirm this with my counterparts.
>
> When the account is deleted, the workstation is not able to be used on
> the domain. On logon, it says that the domian is unnavailable or the
> account was deleted. Checking inside AD, you can verify the account no
> longer exists.
>
> I have enabled auditing on all 6 DC's. When the account is deleted, I
> go through and check the last 24 hours but there is no mention of
> event ID 647. I have also checked scheduled tasks that other admin's
> may have enabled are there is nothing I found running against AD. I
> would assume if a script was deleting these accounts, event ID 647
> would pop up.
>
> Google is not being cooperative either.
>
> I will be running dcdiag on all DC's throughout the day user requests
> permitting.
>
> Is there another way I can find out how these accounts are being
> deleted?
> Is there something I'm missing?
> Any thoughts?
>
> Any help would be greatly appreciated.
>
> Matt
>
> http://forums.techarena.in
>
Previous Topic:RPC
Next Topic:ADPREP error message 0x2095
Goto Forum:
  


Current Time: Wed Jan 17 05:45:06 MST 2018

Total time taken to generate the page: 0.02063 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software