Is there a way to tell who disabled a user and when in Windows Server?

Question

Title pretty much says it all. I'm trying to figure out how and when a particular user was disabled.

score 2 · Accepted Answer · answered Apr 13 '12 at 13:30

2

If you have auditing enabled for account management activities ahead of time. More on how to do so here: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

answered Apr 13 '12 at 13:30

uSlackr

8,995

score 1 · Answer 2 · answered Apr 13 '12 at 13:33

I'm assuming that you are using Windows server2008 with Active Directory.

You could find who disabled a user by checking the Event Viewer on the Domain Controller (control panel > administrative tools > event viewer) and looking into the Security Event Log. Check for events with source "Microsoft Windows security auditing" and ID "5136". Into the details of the event, you could find the DN of the user that has been disabled along with date and time of the operation.

Is there a way to tell who disabled a user and when in Windows Server?

2 Answers2