Click here to get back home

Finding out which account added a workstation to the AD...
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Finding out which account added a workstation to the AD... Brian Steele 09-01-2005
Posted by Brian Steele on September 1, 2005, 9:19 am
Please log in for more thread options
 See subject. Any way to determine this?


Regards,
Brian Steele




Posted by Joe Richards [MVP] on September 1, 2005, 6:48 pm
Please log in for more thread options
 You can look at the owner of the object in the ACL and try to figure out from
that.

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Brian Steele wrote:
> See subject. Any way to determine this?
>
>
> Regards,
> Brian Steele
>
>


Posted by Brian Steele on September 2, 2005, 9:43 am
Please log in for more thread options
Thanks Joe, but the owner of the computer object is listed as "Domain
Admins".

I did get a clue from the ACL though about who might be responsible - a user
name popped up with "change password" privs for the computer account in
question. I'll investigate further.

Thanks,
Brian Steele


> You can look at the owner of the object in the ACL and try to figure out
> from that.
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> www.joeware.net
>
>
> Brian Steele wrote:
>> See subject. Any way to determine this?
>>
>>
>> Regards,
>> Brian Steele




Posted by Joe Richards [MVP] on September 2, 2005, 4:52 pm
Please log in for more thread options
Sounds like a domain admin created the account and configured the machine to be
able to be joined by the ID that you saw that had change password rights.


--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Brian Steele wrote:
> Thanks Joe, but the owner of the computer object is listed as "Domain
> Admins".
>
> I did get a clue from the ACL though about who might be responsible - a user
> name popped up with "change password" privs for the computer account in
> question. I'll investigate further.
>
> Thanks,
> Brian Steele
>
>
>
>>You can look at the owner of the object in the ACL and try to figure out
>>from that.
>>
>>--
>>Joe Richards Microsoft MVP Windows Server Directory Services
>>www.joeware.net
>>
>>
>>Brian Steele wrote:
>>
>>>See subject. Any way to determine this?
>>>
>>>
>>>Regards,
>>>Brian Steele
>
>
>


Posted by Andra on September 5, 2005, 5:13 pm
Please log in for more thread options
Win2003
it may be better to set Default Domain Security Settings->Local
Policy->Security Options->System objects: Default owner for objects created
by members of the Administrators group = Object creator.

Brian Steele wrote
> Thanks Joe, but the owner of the computer object is listed as "Domain
> Admins".
>
> I did get a clue from the ACL though about who might be responsible - a
user
> name popped up with "change password" privs for the computer account in
> question. I'll investigate further.
>
> Thanks,
> Brian Steele
>
>
> > You can look at the owner of the object in the ACL and try to figure out
> > from that.
> >
> > --
> > Joe Richards Microsoft MVP Windows Server Directory Services
> > www.joeware.net
> >
> >
> > Brian Steele wrote:
> >> See subject. Any way to determine this?
> >>
> >>
> >> Regards,
> >> Brian Steele




Similar ThreadsPosted
Added to Domain Admins but removed again automatically March 7, 2008, 1:53 pm
Root certificate authority no longer added to client machines July 14, 2006, 4:05 pm
added four server names to the administrator group of a file serve July 16, 2008, 5:31 pm
Finding Product Keys July 16, 2007, 5:47 am
Finding folders where user was specifically given access September 11, 2006, 1:45 pm
Finding Which Application Requires Specific User Privilege? December 26, 2006, 3:17 am
Finding all ntfs folders showing a specific group in ACL... March 26, 2008, 4:43 pm
Add workstation to Domain July 28, 2006, 10:48 am
Workstation Authentication December 4, 2007, 3:56 pm
Auditing Workstation logons from DC January 24, 2006, 7:29 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap