Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Title pretty much says it all. I'm trying to figure out how and when a particular user was disabled.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you have auditing enabled for account management activities ahead of time. More on how to do so here: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

share|improve this answer
    
Thanks for the help. –  Kevin Apr 13 '12 at 19:11

I'm assuming that you are using Windows server2008 with Active Directory.

You could find who disabled a user by checking the Event Viewer on the Domain Controller (control panel > administrative tools > event viewer) and looking into the Security Event Log. Check for events with source "Microsoft Windows security auditing" and ID "5136". Into the details of the event, you could find the DN of the user that has been disabled along with date and time of the operation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.