Forum

Ultimate Windows Security Forum » Security Log » 4729 - A member was removed from a... » How to monitor for a user being removed from...

How to monitor for a user being removed from... Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
TomMartin
Posted 6/18/2011 9:58:26 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 6/9/2011 6:34:57 PM
Posts: 6, Visits: 1
I have a security enabled global group I need to monitor for when users are removed. When a user gets removed I'm alerted with security event id 4729 - which is good. But, the problem is when the user account gets deleted from AD it automatically is removed from the global group, but I don't receive an event id 4729 for this.

How can I monitor for when a user account has been removed from a global group because that user account was deleted from AD?

Thanks,
Tom Martin
Post #735
RandyFranklinSmith
Posted 6/21/2011 1:39:51 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
Sorry, Tom, Windows doesn't log anything for you in this case.  :-(

You could try auditing that group with Directory Services Changes.  Specifically the 'members' property

Post #739
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:38am