Events for "A user account enabled /... Expand / Collapse
Author
Message
Posted 7/8/2014 5:25:47 AM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 2/19/2015 5:29:35 AM
Posts: 10, Visits: 11
Hi:

I am seeing the events " A user account enabled / disabled" with target username as machinename with $

(CHNOMR0001D$). So I am not able to find whose account is enabled or disabled.

All the events for "A user account enabled / disabled" triggering with machinename with $ only.

Please help me on how to get the exact target usernames.

Thanks & Regards,

Sundar

Post #1349
Posted 8/4/2014 6:39:59 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
From my experience this is when a computer is added to a domain. The $ is a computer account.
Post #1361
Posted 8/7/2014 9:28:24 AM
Junior Member

Junior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior MemberJunior Member

Group: Forum Members
Last Login: 2/19/2015 5:29:35 AM
Posts: 10, Visits: 11
Thanks derekthomas for your valuable response.

With your help, I am able to understand that these events are generated when the machine is added to the domain account.

But I am not seeing the events with proper user name if any user account is enabled or disabled.

Kindly help me to understand if any particular event to identify the user account is enabled or disabled.

Is any auditing option needs to be enabled to get these events?

Thanks in Advance!

Regards,

Sundar



 

Post #1366
Posted 9/8/2014 6:31:57 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
If you are seeing the events for enabled/disabled for machine names then you should be seeing the same events for users. This event does require logging for "success" in the "user account management subcategory". This event should coincide with user creation as well.
Post #1562
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 4:11am