Event id delete user active directory

Home
Windows
Windows Server

Posted by hutsonford 2021-09-01T18:43:36Z

Nội dung chính Show

Read these next...
Snap! -- Bike Desks, Terahertz Wireless, Holographic Tech, Prehistoric Comet
Need to setup a wireless bridge between 2 buildings using Ubiquiti products
Spark! Pro series - 4th January 2023
With two computers and one set of peripherals, need a switch of sorts?
HDD data recovery problem (sought professional help)
What is Event ID 4738?
What is event ID 4733?
What is event ID 5141?
What is Event ID 4732?

Had a user contact us today stating that they couldn't log into their PC.

Thinking it was a simple password issue, we went to unlock their account only to discover that their account no longer existed in AD.

My logs are not showing the account as having been deleted, disabled or expired.

Anyone have a suggestion to take a look into?

14 Replies

Check the security logs for event id 4726. Also do you have the AD recycle bin enabled so you can restore the user?
Was this post helpful? thumb_up thumb_down
I have checked the viewer for 4726 (deleted), 4738 (changed), and 4781 (name changed).
The AD recycle bin is not enabled unfortunately.
Was this post helpful? thumb_up thumb_down
jrp78
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
ghost chili
Windows Server Expert
- check 81 Best Answers
- thumb_up 259 Helpful Votes
+1 on the recycle bin(IF you have it enabled). You have to be at or above DFL 2008R2 for this feature to be available. If you don't have it enabled, I would consider turning it on for future use. However, please note that once this is turned on, you can never rollback your DFL if you needed to for some reason.
To check for a deleted user(again if the recycle bin is turned on), you have to go to ADAC(Active Directoy Admin Center) instead of ADUC. From the root of your domain, you should see a container called "Deleted Objects". Within that container, you can search for deleted users. The default timeframe before accounts are deleted from the recycle bin is 60 days.
You will find plenty of articles on how to enable the AD recycle bin if you want/need to turn it on.
https://redmondmag.com/articles/2015/11/11/enable-the-active-directory-recycle-bin.aspx Opens a new window

What is your current backup solution? Does it have any application aware capabilities? Veeam can restore AD accounts(if you have it setup for application aware processing) and it has saved me many times.
Was this post helpful? thumb_up thumb_down
jrp78
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
ghost chili
Windows Server Expert
- check 81 Best Answers
- thumb_up 259 Helpful Votes
Did someone possibly rename the account? Are there any attributes that you may be able to look through to ID the user even if someone changed the displayname and/or samaccountname?

Was this post helpful? thumb_up thumb_down
I've already recreated account...and I'm going to be talking to my manager about enabling the recycle bin. My curiosity is more along the lines of finding out what could have possibly happened to it since its not showing up in the event viewer.
1 found this helpful thumb_up thumb_down
I dont think that the account was renamed or changed. I would assume that event ID 4781 and 4738 would have found evidence of that.
Was this post helpful? thumb_up thumb_down
jrp78
This person is a verified professional.
Verify your account to enable IT peers to see that you are a professional.
ghost chili
Windows Server Expert
- check 81 Best Answers
- thumb_up 259 Helpful Votes
Yep, I hear ya. Do you have more than one DC? If you so, are you checking events on the DC that holds the PDC Emulator role?
Was this post helpful? thumb_up thumb_down
Do you also have all of the account management auditing enabled? If you create a test account and delete that from AD and then filter your security event logs do you see that deletion in the logs?
https://www.lepide.com/how-to/audit-user-account-changes-in-active-directory.html Opens a new window
Was this post helpful? thumb_up thumb_down
Was there any account expiry date set? In case you want to restore deleted AD objects in future this article https://www.lepide.com/how-to/restore-deleted-objects-in-active-directory.html Opens a new window could be useful.
Was this post helpful? thumb_up thumb_down
I would highly recommend that you follow the instructions at https://system32.eventsentry.com/security/auditing_for_everyone Opens a new window and enable minimum auditing on your network.
Obviously you should have some sort of monitoring solution in place, but that's secondary. But with auditing enabled (and sufficiently large event logs), you would at least have an audit trail to come back to rather than wondering what happened.
I'll also say that it's somewhat suspicious that a user account just "disappeared" from your AD. Accounts don't just disappear, so someone or something deleted that account, either by accident or on purpose. Of course I know nothing about your network size, admin team size etc, but starting to pay more attention is probably not a bad idea to prevent something worse from happening.

Was this post helpful? thumb_up thumb_down
if this was mentioned already, my apologies, and I did see you already remade the account so the cats out of the bag so to speak.
So prepping for next time...
Another tool in your bag could be using LPD to find Tombstone objects, see this article https://www.windows-active-directory.com/active-directory-tombstones.html Opens a new window
It won't necessarily tell you any of the why, but if I recall it can tell you when it was Tombstoned / deleted to help in your search. Honestly, I don't recall if it's easier to just make a new one or restore this way as restoring the tombstone much was lost if I recall.
Powershell
```
# from workstation
Get-EventLog -LogName Security -ComputerName <DC name>| Where-Object {$_.EventID -eq 4726} |
Select-Object -Property *

# from DC (I don't recommend)
Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4726} | Select-Object -Property *
```
Good luck for next time
Was this post helpful? thumb_up thumb_down
Follow Restoring a User Object using AD Administrative Center Opens a new window Opens a new window manual.
And yes - you need auditing. Check Audit Policy Best Practices Opens a new window to setup policies.
As for Netwrix Auditor (Atom60m6, thanks for heads-up!) - Netwrix Auditor for Active Directory empowers you to quickly recover deleted Active Directory user or computer accounts Opens a new window, groups and organizational units to a previous state
Was this post helpful? thumb_up thumb_down
Im sorry for the delayed response. I think this was figured out. It turns out that a co-worker had deleted an account from exchange, and apparently that can propagate over and remove an account from AD. Or at least that's what I was able to piece together after looking the logs that we do have.
Thanks for the assistance.
Was this post helpful? thumb_up thumb_down
Was this post helpful? thumb_up thumb_down

Read these next...

Snap! -- Bike Desks, Terahertz Wireless, Holographic Tech, Prehistoric Comet
Spiceworks Originals
Your daily dose of tech news, in brief. Welcome to the Snap! Flashback: Back on January 4, 1972: First Handheld Scientific Calculator (Read more HERE.) Bonus Flashback: Back on January 4, 1970: NASA cancels Apollo 20 moon mission (Read mo...
Need to setup a wireless bridge between 2 buildings using Ubiquiti products
Networking
Hi,Ubiquiti are not good at explaining their products so here I am:I need a wireless bridge between 2 buildings. clear line of sight. 800 feet. 400mb+ and low latency because of VOIPThey have a section called ISP OPERATOR with cheap products like UISP ...
Spark! Pro series - 4th January 2023
Spiceworks Originals
Today in History: 1944 Operation Carpetbagger begins (aerial dropping of supplies and weapons to resistance fighters in Europe)The purpose of the operation Carpetbagger project was to fly “Special Operations” to deliver supplies to resistance groups in en...
With two computers and one set of peripherals, need a switch of sorts?
Hardware
So, in essence I've got a user with two different computers for two different organization, and they've got a dual monitor setup and mouse and keyboard all running into a single docking station. They have to unplug one computer and plug in the other anyti...
HDD data recovery problem (sought professional help)
Data Storage, Backup & Recovery
Hello all,I had a 20+ year old seagate HDD that stopped working a while ago. I tried recovery with software first, but no luck. Then I brought it to 2 professional data recovery centers, but they said they couldn't recover any data even though the disk ap...

What is Event ID 4738?

Event 4738 is generated every time a user object is changed. At times, this event may not show any changes—that is, all Changed Attributes appear as “-. “ This usually happens when a change is made to an attribute that is not listed in the event. In this case, there's no way to determine which attribute was changed.

What is event ID 4733?

Event Description: This event generates every time member was removed from security-enabled (security) local group. This event generates on domain controllers, member servers, and workstations. For every removed member you will get separate 4733 event.

What is event ID 5141?

Description. This event documents deletion of AD objects, identifying the object deleted and user who deleted it.

What is Event ID 4732?

Event ID 4732 – A member was added to a security-enabled local group. As described, this Event ID tracks when a member — either a domain user or local user — is added to any security-enabled local group. There are many local groups, but the most commonly monitored local group is the local Administrator group.

Event id delete user active directory

14 Replies

Read these next...

Snap! -- Bike Desks, Terahertz Wireless, Holographic Tech, Prehistoric Comet

Need to setup a wireless bridge between 2 buildings using Ubiquiti products

Spark! Pro series - 4th January 2023

With two computers and one set of peripherals, need a switch of sorts?

HDD data recovery problem (sought professional help)

What is Event ID 4738?

What is event ID 4733?

What is event ID 5141?

What is Event ID 4732?

Bài Viết Liên Quan

Quảng Cáo

Có thể bạn quan tâm

Toplist được quan tâm

Quảng cáo

Xem Nhiều

Quảng cáo

Chúng tôi

Điều khoản

Trợ giúp

Mạng xã hội