Title pretty much says it all. I'm trying to figure out how and when a particular user was disabled.
If you have auditing enabled for account management activities ahead of time. More on how to do so here: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx
I'm assuming that you are using Windows server2008 with Active Directory.
You could find who disabled a user by checking the Event Viewer on the Domain Controller (control panel > administrative tools > event viewer) and looking into the Security Event Log. Check for events with source "Microsoft Windows security auditing" and ID "5136". Into the details of the event, you could find the DN of the user that has been disabled along with date and time of the operation.
protected by Community♦ Jan 24 at 16:37
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?