Re: Computer join/disjoin log

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 04/23/05


Date: Fri, 22 Apr 2005 18:46:52 -0500

In Domain Controller Security policy enable auditing of account management
and look for events 645,646,647. You will have to look in the security logs
of all the domain controllers to find the pertinent events. Event Comb is
free from MS and can make the job a lot easier by scanning the security logs
of multiple computers centrally. The link below may help. --- Steve

http://www.microsoft.com/technet/security/prodtech/windows2000/secmod144.mspx

"Brent" <brent.andersonRemoveThis@brun.k12.va.us> wrote in message
news:%233yjpp4RFHA.2964@TK2MSFTNGP15.phx.gbl...
> On a Windows 2000 domain network does the server keep a log of computers
> that join and disjoin the domain with the user account that was used to
> disjoin it form the domain? Is there any entry that would be saved to the
> system that was disjoined with that info?
>



Relevant Pages

  • Re: Cannot browse to a domain controller across windows domains
    ... There are no security audit entrys success ... > or failure in the security logs when I try to log on...as though the ... > workstation which I am trying to browse the DC with has never contacted ... > to the domain controller of the outside domain. ...
    (microsoft.public.windows.server.networking)
  • Re: Adding Computers to the Domain
    ... then review your security logs in Event Viewer on the domain controllers for Event ID ... right -add workstations to the domain in Domain Controller Security Policy. ...
    (microsoft.public.win2000.security)
  • Re: Password Visibility
    ... Your best bet is to enable auditing of account management on domain ... controllers and then looking in the security logs of the domain controllers ... be sure to increase the size of the security logs substantially. ...
    (microsoft.public.windows.server.security)
  • Re: How to audit who adds computers to domain
    ... Enable auditing of acount managment events in your Domain Controller ... Security Policy and then look for event ID 645 in the security logs in Event ... Microsoft to do this for multiple computers at a time. ...
    (microsoft.public.win2000.networking)
  • SDDL confirmation -- Set event log security for the domain
    ... Article 323076 talks about registry settings to allow "domain" access to ... security logs for a particular group. ... that this change is static and will only affect one "local" domain controller. ... Roy ...
    (microsoft.public.windows.server.active_directory)