Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » who change the ad data base
who change the ad data base [message #161721] Tue, 06 October 2009 12:21 Go to next message
gaurav_abbot  is currently offline gaurav_abbot  United States
Messages: 4
Registered: October 2009
Junior Member
Suppose We have ten AD admins in a domain , one of the AD admin had make
a mistake , he had deleted the OU & which replicated to all the domain
controllers in domain. Pl. advice me How can we find out that who had
done the disaster ?


--
gaurav_abbot
------------------------------------------------------------ ------------
gaurav_abbot's Profile: http://forums.techarena.in/members/141088.htm
View this thread: http://forums.techarena.in/active-directory/1255349.htm

http://forums.techarena.in
Re: who change the ad data base [message #161726 is a reply to message #161721] Tue, 06 October 2009 13:49 Go to previous messageGo to next message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello gaurav_abbot,

Only if you have enabled auditing on the domain controllers. Then you have
to check each DC in the event logs.
http://www.ultimatewindowssecurity.com/securitylog/encyclope dia/event.aspx?eventid=565

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Suppose We have ten AD admins in a domain , one of the AD admin had
> make a mistake , he had deleted the OU & which replicated to all the
> domain controllers in domain. Pl. advice me How can we find out that
> who had done the disaster ?
>
> http://forums.techarena.in
>
Re: who change the ad data base [message #162068 is a reply to message #161721] Wed, 14 October 2009 13:54 Go to previous message
SubstituteThisWithMyF  is currently offline SubstituteThisWithMyF  Netherlands
Messages: 85
Registered: October 2009
Member
first check the AD metadata with repadmin /showobjmeta DC "DELETED OBJECT
DN" to see WHERE it was deleted and WHEN
then go to the DC listed and check its event log around the time that was
specified earlier

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------ ------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------ ------------------------------
#################################################
#################################################
------------------------------------------------------------ ------------------------------

"gaurav_abbot" <gaurav_abbot.3zng3c@DoNotSpam.com> wrote in message
news:gaurav_abbot.3zng3c@DoNotSpam.com...
>
> Suppose We have ten AD admins in a domain , one of the AD admin had make
> a mistake , he had deleted the OU & which replicated to all the domain
> controllers in domain. Pl. advice me How can we find out that who had
> done the disaster ?
>
>
> --
> gaurav_abbot
> ------------------------------------------------------------ ------------
> gaurav_abbot's Profile: http://forums.techarena.in/members/141088.htm
> View this thread: http://forums.techarena.in/active-directory/1255349.htm
>
> http://forums.techarena.in
>
>
> __________ Information from ESET Smart Security, version of virus
> signature database 4507 (20091014) __________
>
> The message was checked by ESET Smart Security.
>
> http://www.eset.com
>
>
>

__________ Information from ESET Smart Security, version of virus signature database 4507 (20091014) __________

The message was checked by ESET Smart Security.

http://www.eset.com
Previous Topic:Synchronize Active Directory 2008 with LDAP
Next Topic:RODC ...
Goto Forum:
  


Current Time: Thu Jan 18 20:49:50 MST 2018

Total time taken to generate the page: 0.03716 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software