Account changed on a DCPromo? Expand / Collapse
Author
Message
Posted 1/12/2010 1:48:48 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 2/11/2012 12:15:37 AM
Posts: 18, Visits: 8
I'm trying to use the security log to identify DCPromo's.  Would this event show sufficient information?

What changes are made to a computer account when we promote it to a DC? 

Could these changes be made to the account a computer that is not being promoted? 

Thanks!

Post #298
Posted 1/14/2010 10:23:25 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Interesting question, Braino.

I don't know 646 logs a recognizable signature attributable to dcpromo or not but I get you could use Directory Service auditing and enable auditing of Write All Properties and get notification that way.  either way testing is requried

Post #299
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:31am