Event Viewer: Finding when user account was deleted.

[hillboy]

How can I tell exactly when a user deleted an user account in event viewer. I have user accounts that are "spontaneously" disappearing. I suspect a fellow worker is doing this and would like to look at the logs on the PDC to get more information. What event ID or description could I use to find deleted accounts. Ohhh...by the way, I can't select "User" in Event Viewr because this user has the Administrator password and we cannot change this(don't ask why...this is a long story).

Thank you in advance....

 

[darranagl]

I would turn on Auditing for your users directories. You can select who to audit (eg Everyone or Administrator etc).

Using Windows Explorer, right click the folders you want to track then take Properties. In the Security tab click Auditing. Select the user you want to track (it sounds like you want to track Administrator and the 'naughty' user's logon), then tick the actions you want to track.

Use the Event Viewer in the Security log to see whats going on. NB the log will get big quickly. New Zealand, a great place to visit.

http://www.southland.org.nz