How can I tell who deleted a user and from what IP?

Hiya Everyone,

Im having an issue where on the current 13.x build where users are being deleted from a domain. I tried looking in the logs and cant find anything but I could just be looking in the wrong place? IS it logged anywhere when an ADMINISTRATOR logs in and does it log when a user may be deleted someplace?

Marc

Employee Replied

5/27/2015 at 3:03 PM

Employee Post Marked As Answer

Marc,

If your Administrative logs are set to detailed, then when a user is deleted from a domain, you would see something similar to this:

[2015.05.27] 14:59:55 PM [10.X.X.X][t5gouz][Domain : DOMAINNAME] Setting Removed by [USERNAME@DOMAINNAME (Domain Admin)] : 	Setting Name: User 
[2015.05.27] 	[Item: DELETED_USERNAME]

Marc Frega Replied

5/27/2015 at 5:01 PM

When I search for the username in the last few days in the admin log all I see is this below. The log is on detailed and I selected to display related traffic.

[2015.05.25] 13:01:20 PM [172.56.36.40][vaqcbt] Attempting to login : cbelaunde@bcag.com
[2015.05.25] 13:01:20 PM [172.56.36.40][vaqcbt][Domain : bcag.com] Login was successful : [cbelaunde@bcag.com (User)]
[2015.05.25] [Item: cbelaunde]
[2015.05.26] 11:56:45 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@bcag.com
[2015.05.26] 11:56:45 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@bcag.com
[2015.05.26] 11:56:47 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@rt4cars.com
[2015.05.26] 11:56:55 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@rt4cars.com
[2015.05.26] 11:57:12 AM [108.58.148.99][ueqey0] Attempting to login : cbelaunde@bcag.com
[2015.05.27] 17:03:25 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@bcag.com
[2015.05.27] 17:03:25 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@bcag.com
[2015.05.27] 17:03:47 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@rt4cars.com
[2015.05.27] [Item: cbelaunde]
[2015.05.27] 18:38:32 PM [172.56.37.85][vaqcbt] Attempting to login : cbelaunde@rt4cars.com
[2015.05.27] 18:38:32 PM [172.56.37.85][vaqcbt][Domain : bcag.com] Login was successful : [cbelaunde@bcag.com (User)]
[2015.05.27] 18:39:31 PM [108.58.148.99][ifb4rh] Attempting to login : cbelaunde@rt4cars.com
[2015.05.27] 18:39:31 PM [108.58.148.99][ifb4rh][Domain : bcag.com] Login was successful : [cbelaunde@bcag.com (User)]

2 Replies

Reply to Thread

Related Knowledge Base Articles

2 Replies

Reply to Thread

Tags

Related Knowledge Base Articles