Re: user accounts are reappearing
From: Tim Hines [MSFT] (timhines_at_online.microsoft.com)
Date: 06/24/04
- Next message: Adam Arndt: "Re: Windows 2000 Licensing Problem"
- Previous message: Steve: "copy user"
- In reply to: tony: "user accounts are reappearing"
- Messages sorted by: [ date ] [ thread ]
Date: Thu, 24 Jun 2004 08:52:49 -0400
You can perform auditing to determine who may be creating accounts. There
is a policy setting called "audit account management" that you can enable.
The description of the setting is below.
Audit account management
Computer Configuration\Windows Settings\Security Settings\Local
Policies\Audit Policy
Description
Determines whether to audit each event of account management on a computer.
Examples of account managment events include:
a.. A user account or group is created, changed, or deleted
b.. A user account is renamed, disabled, or enabled
c.. A password is set or changed
By default, this value is set to No auditing in the Default Domain
Controller Group Policy object (GPO) and in the local policies of
workstations and servers.
If you define this policy setting, you can specify whether to audit
successes, audit failures, or not to audit the event type at all. Success
audits generate an audit entry when any account management event is
successful. Failure audits generate an audit entry when any account
management event fails. You can select No auditing by defining the policy
setting and unchecking Success and Failure.
-- Tim Hines, MCSE, MCSA Windows 2000 Directory Services ===================================================== When responding to posts, please "Reply to Group" via your newsreader so that others may learn and benefit from your issue. ===================================================== This posting is provided "AS IS" with no warranties, and confers no rights. "tony" <anonymous@discussions.microsoft.com> wrote in message news:2047601c45917$b13f1dc0$a101280a@phx.gbl... > I have a windows 2000 AD setup up, however we still have > 2 NT4 DC's on the domain. I can verify that replication > betwene all 2000's dc's is running fine and no servers > have been off the network for more than 5 min for a > reboot over the last 2 years. For some reason user > accounts that have been deleted years ago are reappearing > and I don't know what's causing it. I verified > everything in this MS article > > http://support.microsoft.com/default.aspx?scid=kb;en- > us;314282&Product=win2000 > > Could it be the NT dc's. If not is there a tool to > monitor who creates/deletes an id and when?
- Next message: Adam Arndt: "Re: Windows 2000 Licensing Problem"
- Previous message: Steve: "copy user"
- In reply to: tony: "user accounts are reappearing"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
