General discussion

Locked

date stamp when accounts disabled?

By And_the_beat_goes_on ·
On NT4.0, if the event log does not go back far enough, is there a way to tell the date and time when an NT account was disabled? (maybe somewhere in the registry?)

This conversation is currently closed to new comments.

3 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

date stamp when accounts disabled?

by Lo In reply to date stamp when accounts ...

Hi - Can't answer your question about Registry, would guess that that data isn't stored there. There is probably a security file that has that data, may have a last modified date but I don't know where that is (yet).

If you save event log beforeclearing, you can reload those saved files, or restore from disk if you do backups. Can probably restore backups to another system (work/scratch) to check the log but that is a bit of work.

For future - might consider changing your disable policy to add the disable date to the account description. That way you will have the date no matter what (until it gets reactivated or deleted).

Collapse -

date stamp when accounts disabled?

by And_the_beat_goes_on In reply to date stamp when accounts ...

Poster rated this answer

Collapse -

date stamp when accounts disabled?

by And_the_beat_goes_on In reply to date stamp when accounts ...

This question was closed by the author

Back to Windows Forum
3 total posts (Page 1 of 1)  

Related Discussions

Related Forums