I am seeing the events " A user account enabled / disabled" with target username as machinename with $
(CHNOMR0001D$). So I am not able to find whose account is enabled or disabled.
All the events for "A user account enabled / disabled" triggering with machinename with $ only.
Please help me on how to get the exact target usernames.
Thanks & Regards,
With your help, I am able to understand that these events are generated when the machine is added to the domain account.
But I am not seeing the events with proper user name if any user account is enabled or disabled.
Kindly help me to understand if any particular event to identify the user account is enabled or disabled.
Is any auditing option needs to be enabled to get these events?
Thanks in Advance!