User logon name gets cleared in Active Directory

Question

Any ideas on why this could be happening? I'll get calls from people saying they can't login and when I check, everything in their AD account is fine except the "User logon name:" under the "Account" tab is blanked out.

Answer 1

You probably want to turn on auditing for changes to Active Directory, then when it happens again you can consult the audit trail to see who or what made the change. The group policy you're interested in is:

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Audit Policy → Audit account management

You can set a GPO on the Domain Controllers OU to turn this on. See these articles for details:

• HOW TO: Audit Active Directory Objects in Windows Server 2003
• AD DS Auditing Step-by-Step Guide