Hello,

in environment domain how can i find who deleted a user ? or disable ? by whom ?

is there any way to learn it ?

Regards.

• Edited by Esmirlea 19 hours 15 minutes ago

You cannot find out who deleted a user back in time unless you have auditing turned on.

Use the link below to get you started on turning auditing on and learn the pros and cons.

https://technet.microsoft.com/en-us/library/Dd772693(v=WS.10).aspx

https://technet.microsoft.com/en-us/library/Cc731607%28v=WS.10%29.aspx?f=255&MSPPError=-2147217396

• Edited by vaadadmin2010 19 hours 6 minutes ago
• Proposed as answer by Richard MuellerMVP 17 hours 50 minutes ago

The above suggested references looks good to get this job done.

Moreover, you may also take help from this PDF guide which provides information about how to enable the security audit and to verify the enabled audit policies for Active Directory: https://gallery.technet.microsoft.com/How-to-enable-the-Security-dbddb20d  that allows to keeps track of all changes in Active Directory, identifying when changes are made, who made the change, from where, when and what was changed.