AD : When was user moved to Domain Admin ?

Forums › IT Pro and developers › AD : When was user moved to Domain Admin ?

xpd

Im a pirate
10802 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#91700 19-Oct-2011 12:44

A user account was created earlier this year, and at some point was added to the Domain Admins group - is there anyway for me to find out when it was moved to the Domain Admins group ?
Or are the system logs all there is, and in this case Im probably too late to check (probably overwritten themselves by now).

XPD^ / DemiseNZ

Blog Free Games Twitter My TradeMe Goodies

Pirating in Sea Of Thieves

Coming Soon - BBS door games - all the classics!

jaymz

1096 posts

Uber Geek

#535149 19-Oct-2011 14:22

Possibly a bit late, the only built in way i know of is using the security logs.

More information about how to view the logs are located here: http://www.windowsecurity.com/articles/auditing-users-groups-windows-security-log.html

What level of AD are you running? 2003 or 2008? 2008 has some nice new features in which are worth exploring regarding user auditing and tracking. you can read more about "whats new" here: http://technet.microsoft.com/en-us/library/dd560628(WS.10).aspx

insane

2416 posts

Uber Geek

Trusted

Subscriber

#535377 19-Oct-2011 23:05

xpd: A user account was created earlier this year, and at some point was added to the Domain Admins group - is there anyway for me to find out when it was moved to the Domain Admins group ?
Or are the system logs all there is, and in this case Im probably too late to check (probably overwritten themselves by now).

I guess this is why there should be very few uses who are Domain Admins, also makes finding our who added them easier :) .

It's so tempting to make your normal user account a Domain admin as it makes day\-to-day admin work easy, but very bad practice.

Sadly the logging within windows by default is so poor, quite bizarre given how critical it is.

xpd

Im a pirate
10802 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#535431 20-Oct-2011 08:31

Yeah, we only have a few admins - managed to find the info tho, change was only amde in past week so thankfully still appeared in the logs after a lot of searching :)

Thanks guys

XPD^ / DemiseNZ

Blog Free Games Twitter My TradeMe Goodies

Pirating in Sea Of Thieves

Coming Soon - BBS door games - all the classics!