How to find the account used to create a user object

[pozzer]

Hi

Can anyone tell me if it's possible to find which administrative account was used to create a new user object in AD? I don't have auditing turned on but wondered if this info was recorded anywhere such as part of the newly created object.

Thanks

Pozzer

 

[Odissey]

Who is owner for this user object? IMHO this person is creator for object.

WBR, Vadim V. Petukhov,
MCSE2003, CCEA4.0
vadimp@yandex.ru

 

[markdmac]

I took a look using ADSIEdit and don't beleive this is recorded.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[pozzer]

Thanks for the replies.

I haven't been in the office today so can't check who the owner is but I have been researching online and I think you're right Mark. It doesn't look like it's recorded.

Thanks again

Pozzer

 

[itsp1965]

If you have auditing enabled you can perform a lookup of your security event log for the following events;
624 - User account created
645 Computer account created

Hope this helps

 

[markdmac]

itsp1965, the original post states that auditing is not enabled.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[Odissey]

Oooops! This worked for NTFS objects and registry keys, but NOT for AD objects. Sorry...
I am confused

http://support.microsoft.com/kb/318825

WBR, Vadim V. Petukhov,
MCSE2003, CCEA4.0
vadimp@yandex.ru