Is there any event id to know if the computer is on DC or not?

Question

In big companies sometimes the computers may not be in the domain. Can we find it based on coming logs in SIEM?

Answer 1

Hello,

You can check for the following event IDs:

Event ID 3260: Indicates a computer has joined a domain.

Event ID 3261: Indicates a computer has left a domain to join a workgroup.

Additionally, for domain controllers (DC), you can look for:

Event ID 4741: Shows details about new computer accounts created, including who created it.

Event ID 4740: Indicates the source of account lockouts in Active Directory.

Best Regards,

Hania Lian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.