Domain Join

Question

i need to get an alert if i join or disjoin a computer from my domain. any body who has an idea is welcome to share.

Answer 1

Hi @Emorut Edward ,

Thanks for your posting.

Based on your description, you would like to get an alert when computers are joined or disjoined. According to our experience, there is no such built-in function. We could monitor the events in the event viewer about the computer creation and computer change. Or we could use the powershell script to get all the computer objects.

For more information, we could refer to the below links:

https://social.technet.microsoft.com/Forums/windowsserver/en-US/f3fb446c-dc70-43dc-8033-ebf4359d6581/nonwindows-computer-domain-joining-alerts?forum=winserverDS

https://community.spiceworks.com/topic/2005620-receive-message-when-new-computer-is-joined-to-active-directory

https://www.adaxes.com/questions/915/notify-computers-joined-to-domain

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

Best regards
Wesley Li

Answer 2

You have to monitor the following events on all domain controllers:

4741(S): A computer account was created
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741

4743(S): A computer account was deleted
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743

You can complete this task by:

Monitoring tools.
Scheduled tasks along with scripting.

Best regards.

Answer 3

Hello,

Do you have any other questions?

How is the current issue going?

Thanks.

Answer 4

Hello,

Do you have any other questions?

How is the current issue going?

Thanks.