|
Posted by Roger Abell [MVP] on January 29, 2006, 2:04 am
Please log in for more thread options If you were not audition account management events so that you
could try chasing this down in the security event log, then you are
likely out of luck. The account is only some entries in the registry
and these are not owned nor timestamped as far as I am aware.
> Thanks for the information. This account was created in a stand alone
> server, rights have not been modified. I need to find out when and who
> this account was created. Any registry key where I can lokk at it?
>
>
>
>> In AD, if the account object still exists one may look at the create
>> timestamp.
>> The Owner attribute will often tell what account created the object, but
>> this
>> can be changed, and it can only say such as Domain Admins for some cases.
>> As to accounts that no longer exist, or for what rights were given at
>> creation,
>> there is not much of anything in the running system that says (unless the
>> rights
>> have not been changed since creation, the fact of which one could
>> theoretically
>> determine from the security log if account management event success is
>> audited).
>>
>>
>>> Is there any wy to find out when a user account was created and what
>>> rights were assigned to that account?
>>>
>>> Thanks for any tip.
>>>
>>> White
>>>
>>
>>
>
>
| 
XML Sitemap