Mystery of the missing AD User Account

[Roadki11]

Good morning,

I had this same issue on the same windows 2003 standard server SP1 early this spring. After i applied SP1 it cleared up but the issue has returned and i need some help. Seems users are just disappearing from AD. Yesterday 1 user vanished and this morning 2 different user have disappeared. DCDIAG and NETDIAG come back clean. Google says lots of people have had this issue but i see no remedies or pointers to the root cause. Server is 100% up2date on patches and service packs. I have added a 2nd DC, windows 2003 R2 a month ago, has been working fine up until now. The accounts are missing from the replica also. The server with the issue is the FSMO master and the R2 server is a 2nd global catalog server. Both servers run DHCP and DNS(AD Integrated), dns is functioning well. DC's are on different subnets and replication is working fine. Any thoughts?

thanks,

RoadKi11

 

[unclerico]

Just to get a better idea of your environment:
1) Are you the only one that has access to AD?
2) Do you have any applications that manipulate AD (i.e. PeopleSoft)?

 

[Roadki11]

I am the only one with administrative access to the servers. No, i do not have any apps that touch AD.

RoadKi11

 

[Roadki11]

I should rephrase that, i do have Backup Exec 10 doing a nightly system state backup. nothing in the event logs to suggest a problem. no new software has been installed on the server since the last batch of windows updates about 30 days ago. and like i said the problem reappeared yesterday after an 8 month hyatus.

RoadKi11

 

[itsfuntobeme]

NFI! Are the accounts just gone - or are they toombstoned? I think with some research, you can see the toombstoned accounts with ADSIEdit

 

[Roadki11]

The user were tombstoned and i was able to reanimate them with Sysinternals adrestore. Hand little utility, no wonder MS bought them. Im still looking for any ideas why this may be happening. No users vanished last night so i guess thats a good sign.

Thanks,

RoadKi11

 

[itsfuntobeme]

If they are being toombstoned, it means there is an explicit delete command being executed. I don't know how - but there has to be a way of creating debugging logs for NTFRS?

 

[itsp1965]

Do you have auditing enabled? Check the event logs to see who last accessed the affected user objects. Hope this helps.

Regards

Terry

 

[DavisNT]

Enable auditing of Account Management...