How can I tell who deleted a user and from what IP?
Question asked by Marc Frega - 5/27/2015 at 2:56 PM
Hiya Everyone,
Im having an issue where on the current 13.x build where users are being deleted from a domain.  I tried looking in the logs and cant find anything but I could just be looking in the wrong place?  IS it logged anywhere when an ADMINISTRATOR logs in and does it log when a user may be deleted someplace?

2 Replies

Reply to Thread
Employee Replied
Employee Post Marked As Answer
If your Administrative logs are set to detailed, then when a user is deleted from a domain, you would see something similar to this:
[2015.05.27] 14:59:55 PM [10.X.X.X][t5gouz][Domain : DOMAINNAME] Setting Removed by [USERNAME@DOMAINNAME (Domain Admin)] : 	Setting Name: User 
[2015.05.27] 	[Item: DELETED_USERNAME]
Marc Frega Replied
When I search for the username in the last few days in the admin log all I see is this below. The log is on detailed and I selected to display related traffic.

[2015.05.25] 13:01:20 PM [][vaqcbt] Attempting to login :
[2015.05.25] 13:01:20 PM [][vaqcbt][Domain :] Login was successful : [ (User)]
[2015.05.25] [Item: cbelaunde]
[2015.05.26] 11:56:45 AM [][ueqey0] Attempting to login :
[2015.05.26] 11:56:45 AM [][ueqey0] Attempting to login :
[2015.05.26] 11:56:47 AM [][ueqey0] Attempting to login :
[2015.05.26] 11:56:55 AM [][ueqey0] Attempting to login :
[2015.05.26] 11:57:12 AM [][ueqey0] Attempting to login :
[2015.05.27] 17:03:25 PM [][vaqcbt] Attempting to login :
[2015.05.27] 17:03:25 PM [][vaqcbt] Attempting to login :
[2015.05.27] 17:03:47 PM [][vaqcbt] Attempting to login :
[2015.05.27] [Item: cbelaunde]
[2015.05.27] 18:38:32 PM [][vaqcbt] Attempting to login :
[2015.05.27] 18:38:32 PM [][vaqcbt][Domain :] Login was successful : [ (User)]
[2015.05.27] 18:39:31 PM [][ifb4rh] Attempting to login :
[2015.05.27] 18:39:31 PM [][ifb4rh][Domain :] Login was successful : [ (User)]

Reply to Thread