Hello, I am speaking about on a Windows 2008 r2 server. I was wonder if there is a log or if there is anyway to find out when a local user is removed from the server by an admin.

Hi, In Windows Server 2008 R2, the "User Account Management" advanced audit policy is enabled by default. You can run the following command in Command Prompt window to verify it: auditpol /get /category:"account management" Note: Please open Command Prompt window by "Run as administrator". If "User Account Management" is set to "Success", the behavior such as "a local user is removed from the server by an admin" will be recorded in Security event log. The event log is: 4726: A user account was deleted It records which user has been deleted and who did this. You can query the event ID to find it. Hope this helps. Regards, Bruce

Thank you so much. That was exactly what I needed and could not find!

Hi, In Windows Server 2008 R2, the "User Account Management" advanced audit policy is enabled by default. You can run the following command in Command Prompt window to verify it: auditpol /get /category:"account management" Note: Please open Command Prompt window by "Run as administrator". If "User Account Management" is set to "Success", the behavior such as "a local user is removed from the server by an admin" will be recorded in Security event log. The event log is: 4726: A user account was deleted It records which user has been deleted and who did this. You can query the event ID to find it. Hope this helps. Regards, Bruce

Glad to hear the information I provided was useful. If you have more questions in the future, youre welcomed to this forum. Have a nice day!