Active Directory Forest Recovery
The helpdesk phone had been ringing incessantly all day. Many people throughout the AD forest were unable to login to their respective domains. It seems that accounts throughout the forest had somehow been deleted. John, tired from having been up all night watching "White and Nerdy", was called in to help identify what was going on. Fortunately he had recently enabled auditing for account deletions due to a recent problem that he had. After some serious filtering he was able to find the following event in the Security event log: Event Type: Success Audit Event Source: Security Event Category: Account Management Event ID: 630 Date: 1/17/2007 Time: 12:30:44 AM User: Contoso\JuniorAdmin Computer: DisgruntledXP Description: User Account Deleted: Target Account Name: JustinTurner Target Domain: Contoso Target AccountID: Justin Turner []DEL:3f4567f2-f90b-493e-81a3-dcfc75596cd7 Caller User Name: JuniorAdmin Caller Domain: Contoso This was a little offsetting to say the least. ...