Re: AD Group Detective - Need to know who created a particular SG

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

use REPADMIN /SHOWOBJMETA <SOMEDC> <DN of group>

check on which DC the objectClass attribute originated...also note the
date/time

check that DC its security event log for account management using the
date/time....you should then find the creator of the group in the event

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"Alan" <Alan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DCEEF00E-F545-4805-859F-ED7B6DBD6BB3@xxxxxxxxxxxxxxxx
Hello,

I would like to find out who created a specific group. This particular
group was created without a valid description, and no detailed information
about it's use. Is there a way for me to find out which admininistrator
created this group? Any help or suggestions would be appreciated.

Thanks,

Alan


.

Relevant Pages

  • Re: Account Lockout
    ... the DC where the account gets locked logs this in the security event log on ... # Jorge de Almeida Pinto # MVP Windows Server - Directory Services ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... logon name, domain and workstation name. ...
    (microsoft.public.win2000.security)
  • Re: Logging/tracking AD changes
    ... you need to turn on auditing for Directory Service Access (success). ... then check the security event log ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ...
    (microsoft.public.windows.server.active_directory)