User account getting deleted from on prem AD when any change is made to their properties

Question

I have a user account in on prem AD that gets deleted when any changes are made to the account preferences such as adding or removing group membership etc. It's also getting randomly deleted periodically. All other accounts are fine. It's repeatable easily, a restore via Active Directory Administration Centre works but as soon as we repeat any changes the account gets deleted again.

Answer 1

If the effected user logs in to the domain it also deletes his user account on the AD...

Answer 2

The audit logs are enabled and the problem isn't that anyone is deleting the account. It's being deleted as soon as any change is made to the properties. I'm the only person who has the access to delete accounts, clearly it's not me deleting the account. It's user specific, no other accounts are effected. I can modify properties on any other account, this user account is deleted when any change is made to group membership, either adding or deleting.

Answer 3

Hello Adrian Stowe,

Thank you for posting in Q&A forum.

To detect who deleted a user account in Active Directory Step 1: Enable Group Policy Auditing Settings On one Domain Controller, run GPMC.msc → open “Default Domain Policy” → Computer Configuration → Policies → Windows Settings → Security Settings: Local Policies → Audit Policy → Audit account management → Define → Success After you configure the GPO setting, run gpupdate /force on this DC. Note: 1.If you have never configured any advanced audit policy before, then you can configure the legacy audit policy. 2.If you have configured any advanced audit policy before, then you need to configure the advanced audit policy. 3.Once you configured any one advanced audit policies, then all legacy audit policies will be overwritten by default. Step 2: Configure Event Log Settings Computer Configuration → Policies → Windows Settings → Security Settings: Event Log → Define → Maximum security log size to 1gb and Retention method for security log to Overwrite events as needed. Step 3: Open AD users and computers, find the parent object of this AD account you mentioned (such as OU or domain) → right click “OU or domain name” → Properties → Security (Tab) → Advanced → Auditing (Tab) → Click “Add” → Choose the following settings: Principal: Everyone Type: Success Applies to: This object and all descendant objects Permissions: Delete all child objects → Click “OK”.

After the AD account is deleted next time, please check the event ID 4726 on DC. Then you may know who deleted this account via event ID 4726.

Reference:
https://community.spiceworks.com/how_to/120943-how-to-detect-who-deleted-a-user-account-in-active-directory

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

---

---

f the Answer is helpful, please click "Accept Answer" and upvote it.