Hi Everyone

One of the administrators here deleted an A entry in our 2003 Active
Directory Integrated DNS. Is there a way to track the user who did this? i.e
In Logs? I'm not sure if the will be logged in the security logs of the
Domain Controllers? Would looking for a 564 Security Audit (Object Deleted)
event pick this up?

Your is appreciated

"Brendon B" <BrendonB@discussions.microsoft.com> wrote in message
news:E568207F-68A3-4EF2-8621-FEEB9CE0C658@microsoft.com...
> Hi Everyone
>
> One of the administrators here deleted an A entry in our 2003 Active
> Directory Integrated DNS. Is there a way to track the user who did this?
i.e
> In Logs? I'm not sure if the will be logged in the security logs of the
> Domain Controllers? Would looking for a 564 Security Audit (Object
Deleted)
> event pick this up?

Not unless you have enabled the appropriate auditing setting
(DS objects) AND selected the AD DNS objects to be auditing
with ACLs. (both unlikely.)

> Your is appreciated

Do you perhaps have too many admins?

Hi Martin

That may be the case

We have the following auditing in place on our Domain controllers:

Audit account logon events No auditing
Audit account management Success, Failure
Audit directory service access No auditing
Audit logon events Success, Failure
Audit object access Success, Failure
Audit policy change Success
Audit privilege use Success
Audit process tracking Success
Audit system events Success, Failure

Would this deletion have been covered in one of the categories above?
If so, what event would I have to look for?

Regards
Brendon

"Brendon B" <BrendonB@discussions.microsoft.com> wrote in message
news:51F45B04-C561-47AF-BF80-6FC8C86BF275@microsoft.com...
> Hi Martin
>
> That may be the case
>
> We have the following auditing in place on our Domain controllers:
>
> Audit account logon events No auditing
> Audit account management Success, Failure
> Audit directory service access No auditing

IF this auditing were enabled you
COULD enable auditing on AD objects you wish to monitor
and get the audit records in the security log ( it can get big
and out of control rapidly however.)


> Audit logon events Success, Failure
> Audit object access Success, Failure
> Audit policy change Success
> Audit privilege use Success
> Audit process tracking Success
> Audit system events Success, Failure
>
> Would this deletion have been covered in one of the categories above?

No. And even if you had enabled (success) for the directory
service object access then you would still have needed to enable
the auditing ACLs (like NTFS permissions) on the actual objects
you wished to monitor.

> If so, what event would I have to look for?

Security event log, object access entries for (primarily) success.