Howdie!

Enable auditing in a gpo linked to the domain controllers OU. It should advise
your dcs to log deletion attempts then. Make sure you check the security logs of
all dcs as only one dc (where the deletion happens) logs it in its eventlog.

Cheers,
florian

-----Original Message-----
From: bhaskar_maahi <bhaskar_maahi@...>
Sent: Montag, 11. Mai 2009 00:07
To: ADSIANDDirectoryServices@yahoogroups.com
Subject: [ADSI-DirSrv] User deletion in AD



Hi Techies,

I am having 10 W2K3 SP2 DC's and 5 Exchange 2003 with SP2 Boxes. User's AD
accounts are getting deleted often. I am not able to track them. Also not sure
from which DC's or Exchange boxes accounts are getting deleted. The security
event for deletion is 630 but how and where to check. Need help to sort this

Please help

Regards,
BT



[Non-text portions of this message have been removed]