How can I tell who deleted a user and from what IP?
Question asked by Marc Frega - 5/27/2015 at 2:56 PM
Answered
Hiya Everyone,
 
Im having an issue where on the current 13.x build where users are being deleted from a domain.  I tried looking in the logs and cant find anything but I could just be looking in the wrong place?  IS it logged anywhere when an ADMINISTRATOR logs in and does it log when a user may be deleted someplace?
 
Marc

2 Replies

Reply to Thread
1
Employee Replied
Employee Post Marked As Answer
Marc,
If your Administrative logs are set to detailed, then when a user is deleted from a domain, you would see something similar to this:
[2015.05.27] 14:59:55 PM [10.X.X.X][t5gouz][Domain : DOMAINNAME] Setting Removed by [USERNAME@DOMAINNAME (Domain Admin)] : 	Setting Name: User 
[2015.05.27] 	[Item: DELETED_USERNAME]
 
0
Marc Frega Replied
When I search for the username in the last few days in the admin log all I see is this below. The log is on detailed and I selected to display related traffic.

[2015.05.25] 13:01:20 PM [172.56.36.40][vaqcbt] Attempting to login : cbelaunde@bcag.com
[2015.05.25] 13:01:20 PM [172.56.36.40][vaqcbt][Domain : bcag.com] Login was successful : [cbelaunde@bcag.com (User)]
[2015.05.25] [Item: cbelaunde]
[2015.05.26] 11:56:45 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@bcag.com
[2015.05.26] 11:56:45 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@bcag.com
[2015.05.26] 11:56:47 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@rt4cars.com
[2015.05.26] 11:56:55 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@rt4cars.com
[2015.05.26] 11:57:12 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@bcag.com
[2015.05.27] 17:03:25 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@bcag.com
[2015.05.27] 17:03:25 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@bcag.com
[2015.05.27] 17:03:47 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@rt4cars.com
[2015.05.27] [Item: cbelaunde]
[2015.05.27] 18:38:32 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@rt4cars.com
[2015.05.27] 18:38:32 PM [172.56.37.85][vaqcbt][Domain : bcag.com] Login was successful : [cbelaunde@bcag.com (User)]
[2015.05.27] 18:39:31 PM [108.58.148.99][ifb4rh] Attempting to login : cbelaunde@rt4cars.com
[2015.05.27] 18:39:31 PM [108.58.148.99][ifb4rh][Domain : bcag.com] Login was successful : [cbelaunde@bcag.com (User)]

Reply to Thread