Active directory Audit

[techierich]

Hi All,

Can anybody please tell me how i could check or be able to tell that if a user account is unlocked within AD who unlocked it ?

Many Thanks,
Rich.

 

[itsp1965]

If you have auditing setup, check for eventid - 642 User account changed

 

[techierich]

Hi itsp1965,

Thank you for your reply. I had a look at that event ID and got the following:

Description:
User Account Changed:
Account Locked.
Target Account Name:alicej
Target Domain:ELMW2
Target Account ID:ELMW2\alicej
Caller User Name:W2DC$
Caller Domain:ELMW2
Caller Logon ID0x0,0x3E7)
Privileges:-

From what i can see on this it only tells you the account that has been locked. what i really need is to know who is unlocking accounts say like the one above. Any suggestions ?

Thanks Again foor your help.
Rich.

 

[itsp1965]

Wouldn't you be able to see the opposite ie.

User Account Changed
Account unlocked

For instance. Or is that not logged?

 

[techierich]

Hi itsp1965,

From what i can make out this event id only show you the account locked and not unlocked. i will test locking and unlocking an acount and see if it shows up in the event id.

Cheers,
Rich.