tip-of-the-dayThe method below works well for Windows Server 2008 and later. If a user has been deleted from the Active Directory, they won’t be able to log into the systems using Windows Authentication. Setting up security logs with a history can help you identify who disabled a user account.

1) Configure Audit Settings

Run gpedit.msc → Create a new GPO → Edit it → Go to “Computer Configuration” → Policies → Windows Settings → Security Settings → Local Policies > Audit Policy:
Audit account management → Define → Success.

2) Configure Event Log Settings

Go to Event Log → Define:
Maximum security log size to 4GB
Retention method for security log to Overwrite events as needed.

3) Assign a Group Policy to an OU

Link the new GPO to OU with User Accounts → Go to “Group Policy Management” → Right-click the defined OU → Choose “Link an Existing GPO” → Choose the GPO that you’ve created.

Force the group policy update → In “Group Policy Management” → Right-click the defined OU → Click on “Group Policy Update”.

4) Configure ADSI Edit

Open ADSI Edit → Connect to Default naming context → Right-click DomainDNS object with the name of your domain → Properties → Security (Tab) → Advanced (Button) → Auditing (Tab) → Add Principal “Everyone” → Type “Success” → Applies to “This object and Descendant objects” → Permissions → Select all check boxes except the following:
Full Control
List Contents
Read all properties
Read permissions > Click “OK”.

5) Filter Event Viewer

Open Event viewer and search Security log for event ID’s 4725 (User Account Management task category).