Auditing and verifying privileged account usage in Active Directory?

Question

How can I check if the certain AD user account is still in use or not?

I am in the process of auditing and validating thousands of users across all of these groups:

Domain Admins
Enterprise Admins
Schema Admins
Administrators
Account Operators
DnsAdmins
Backup Operators
Server Management
Server Operators
Organization Management
Exchange Organization Administrators
Enterprise Key Admins
Key Admins

Before I remove or delete the AD account, I wanted to check if there is any other indicator, aside from lastlogondate or lastLogon which sometimes is blank for some unknown reason.

Any event ID or auditing policy in GPO to enable would be greatly appreciated.

Thank you in advance.

Answer 1

Hi,

You can enable audit through GPO to trace logon and logoff activities.

I invite you to read the following link for more details:

Audit Success and Failed Logon Attempts in Active Directory

Please don't forget to mark helpful answer as accepted

Answer 2

The majority of events will be recorded in the domain controller where the domain user will be authenticated and other event locally in computer.

Check GPO settings under Advanced Audit Policy Configuration, you will find many audit option with explanation:

Advanced Audit Policy Configuration

Please don't forget to mark helpful answer as accepted