1
How can I tell who deleted a user and from what IP?
Question asked by Marc Frega - May 27, 2015 at 2:56 PM
Answered
Hiya Everyone,
 
Im having an issue where on the current 13.x build where users are being deleted from a domain.  I tried looking in the logs and cant find anything but I could just be looking in the wrong place?  IS it logged anywhere when an ADMINISTRATOR logs in and does it log when a user may be deleted someplace?
 
Marc

1 Reply

Reply to Thread
1
Rod Lasky Replied
May 27, 2015 at 3:03 PM
Employee Post
Marc,
If your Administrative logs are set to detailed, then when a user is deleted from a domain, you would see something similar to this:
[2015.05.27] 14:59:55 PM [10.X.X.X][t5gouz][Domain : DOMAINNAME] Setting Removed by [USERNAME@DOMAINNAME (Domain Admin)] : 	Setting Name: User 
[2015.05.27] 	[Item: DELETED_USERNAME]
 
Rod Lasky
Technical Support Specialist
SmarterTools Inc.
(877) 357-6278
www.smartertools.com

Reply to Thread