Skip to main content

How to Detect Who Deleted a User Account in Active Directory

We know that Active Directory is one of important part on Company system, For Company that do not have any specific staff to manage this server, they will assign all of staff to do job. This will make susceptible to security breach. So we need to know the activity of this server like "Who Deleted a User Account in Active Directory". I get some tips form Netwrix and Social Technet on Microsoft how to do it.
  1. Run GPMC.msc → open “Default Domain Policy” → Computer Configuration → Policies → Windows Settings → Security Settings:
    • Local Policies → Audit Policy → Audit account management → Define → Success
    • Event Log → Define → Maximum security log size to 1gb and Retention method for security log to Overwrite events as needed.
  2. Open ADSI Edit → Connect to Default naming context → right click “DC=domain name” → Properties → Security (Tab) → Advanced → Auditing (Tab) → Click “Add” → Choose the following settings:
    • Principal: Everyone
    • Type: Success
    • Applies to: This object and all descendant objects
    • Permissions: Delete all child objects → Click “OK”.
  3. In order to define what user account was deleted and who deleted it filter Security Event Log for Event ID 4726.
Source: www.netwrix.com | Tutorial on You Tube (Link)
Source: social.technet.microsoft.com by Santosh Bhandarkar

Comments

Popular Posts

karimun ganti alternator 70A

Tanggal 26 november 2011 kemarin terjadi sesuatu hal yang menguras kantong ajaib alias "dompet". gimana tidak, selama perjalanan ke mangga dua, AC mati. setelah benerin AC, malah Aki keok, untung ada bengkel. setelah ganti aki baru, indikator aki masih nyala di kabin driver. karena istri gak mau service atau beli alternator 2nd. akhirnya tanggal 4 desember 2011 kemarin kepasang deh alternator 70 A merk BOSCH pada acara Gathering Karimun Kaskus ke-3.



kartu ucapan nikah galuh

nih kartu ucapan tuk nikahnya galuh... temen sma

FTP Batch Command

kemarin di kantor butuh untuk kirim file otomatis melalui PC ke PC lainnya dengan OS windows 98 di PC sumbernya. solusi paling mudah adalah dengan menggunakan Bacth Commandagar dapat berjalan di windows 98. akhirnya setelah searching sana-sini, ketemu dech solusinya, dengan cara membuat dua file (yang pertama file batch untuk connect ke FTP server, yang kedua file yang isinya command FTP).

pertama-tama buatlah sebuah file batch (selahkan buat menggunakan Notepad), dengan nama file "Command_Ftp.bat" yang isinya:
REM Perintah ini untuk Upload All file secara otomatis ke FTP server tertentu

CLS

@echo off

:: variables
set drive="C:\Log_SendFtp_"
SET dateNtime="%date:~10,4%%date:~4,2%%date:~7,2%-%time:~0,2%%time:~3,2%"
rem "Fri 03/12/2010---------10:37:26.27"

echo "************************************************" >> %drive%(%dateNtime%).txt
 date /t >> %drive%(%dateNtime%).txt
 time /t >> %drive%(%dateNtime%).txt
echo
echo "****…