Active directory audit log

la reine de paix 1 Reputation point
2022-06-28T07:28:38.957+00:00

Hi All,

in my environment ,I can't install active directory tools like AD manager plus
so I usually view some eventlogs like changing password or disable or enable the account by filtering the event ID
but one of the users accounts was expired ,and I neeed to check the admin who made this account to expire .is there an event id for changing account expiry date

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,862 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Gary Reynolds 9,591 Reputation points
    2022-06-28T09:19:03.297+00:00

    Hi @la reine de paix

    Have a look at this article which might satisfy your request.

    https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136

    You will have to use the event viewer on the DC or the powershell to pull the event log details from the domain controllers.

    Gary.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.