Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Title pretty much says it all. I'm trying to figure out how and when a particular user was disabled.

share|improve this question
up vote 2 down vote accepted

If you have auditing enabled for account management activities ahead of time. More on how to do so here: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

share|improve this answer
    
Thanks for the help. – Kevin Apr 13 '12 at 19:11

I'm assuming that you are using Windows server2008 with Active Directory.

You could find who disabled a user by checking the Event Viewer on the Domain Controller (control panel > administrative tools > event viewer) and looking into the Security Event Log. Check for events with source "Microsoft Windows security auditing" and ID "5136". Into the details of the event, you could find the DN of the user that has been disabled along with date and time of the operation.

share|improve this answer

protected by Community Jan 24 '15 at 16:37

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.