How can I tell who deleted a user and from what IP?
Question asked by Marc Frega - May 27, 2015 at 2:56 PM
Hiya Everyone,
Im having an issue where on the current 13.x build where users are being deleted from a domain.  I tried looking in the logs and cant find anything but I could just be looking in the wrong place?  IS it logged anywhere when an ADMINISTRATOR logs in and does it log when a user may be deleted someplace?

1 Reply

Reply to Thread
Rod Lasky Replied
Employee Post
If your Administrative logs are set to detailed, then when a user is deleted from a domain, you would see something similar to this:
[2015.05.27] 14:59:55 PM [10.X.X.X][t5gouz][Domain : DOMAINNAME] Setting Removed by [USERNAME@DOMAINNAME (Domain Admin)] : 	Setting Name: User 
[2015.05.27] 	[Item: DELETED_USERNAME]
Rod Lasky
Technical Support Specialist
SmarterTools Inc.
(877) 357-6278

Reply to Thread