User account intermittently deleted by domain... Expand / Collapse
Author
Message
Posted 10/17/2018 3:36:03 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 10/17/2018 3:28:30 AM
Posts: 2, Visits: 0
Hi

Event ID 4726 is logged. This user JDAU0552 and only this user is being deleted in the AD intermittently.

All I see is:

"
A user account was deleted.

Subject:
Security ID: SYSTEM
Account Name: DCAU002$
Account Domain: AU
Logon ID: 0x3E7

Target Account:
Security ID: S-X-X-XX-XXXXXXXXX-XXXXXXXXX-XXXXXXXXXX-XXXXXX
Account Name: JDAU0552
Account Domain: AU

Additional Information:
Privileges -

"

As if the domain controller is deleting the account. How can I get some more details on who the real culprit is?

/Peter
Post #8517
Posted 11/5/2018 7:31:16 AM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 212, Visits: 0
I'm assuming that this account is supposed to remain active? There should be an event 4738 with similar info, can you confirm that this event has the same info? Take a look at all events with the same logon id to see if that can give you a clue as to what may be causing this issue. Take a look at all events that contain this username in the same time frame to see if there is anything else that may indicate why this user is being deleted.
Post #8519
Posted 11/8/2018 6:37:58 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 10/17/2018 3:28:30 AM
Posts: 2, Visits: 0
Yes, the user acccount is supposed to remain and not deleted. There is no Event ID 4738 on any of the DCs on that user account. Only a 4726 and the user account is gone.



/Peter
Post #8520
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:16am