Way to see when a workstation was removed from domain?

[CaRKiLLa]

We have a user that swears that a power outage caused his workstation to remove itself from the domain and add itself to a workgroup (Yeah I know it's a PFM or ID10T error with them not wanting to get in trouble. ) I fixed the issue and now I want to know if there is a way to find out when the machine was taken off of the domain or even when they tried to re-add it to the domain. Looking at the event log, I can see that they did a lot of rebooting the day before the power outage but don't see anything saying that they were making it part of a workgroup.

Thanks.....

 

[pbxman]

Hmmm..did you ask what all the reboots were for? Do you have a time-frame when the power went out, and file modification-dates correlating to reboots?

If the power went out, and all these changes were made upon restart..all system files affected would have the identical modified-dates.

If you find files that were created/modified in even the slightest different times...it's time to can the bastard!

It's impossible to make a software change after power failure because settings are not saved unless a successful shutdown is executed...

- to the Guillotine!!!!!
lol Please let Tek-Tips members know their posts were helpful. Thanks!

Pbxman
Systems Administrator