Forum

Ultimate Windows Security Forum » Security Log » 646 - Computer Account Changed » Account changed on a DCPromo?

Account changed on a DCPromo? Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
Braino
Posted 1/12/2010 1:48:48 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 11/3/2011 10:13:06 PM
Posts: 13, Visits: 7
I'm trying to use the security log to identify DCPromo's.  Would this event show sufficient information?

What changes are made to a computer account when we promote it to a DC? 

Could these changes be made to the account a computer that is not being promoted? 

Thanks!

Post #298
RandyFranklinSmith
Posted 1/14/2010 10:23:25 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 324, Visits: 0
Interesting question, Braino.

I don't know 646 logs a recognizable signature attributable to dcpromo or not but I get you could use Directory Service auditing and enable auditing of Write All Properties and get notification that way.  either way testing is requried

Post #299
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 11:31am