I know VPN users were deleted from Windows 2003 Server. How do I find out when they were deleted?
I'm surfing through the event logs but there are too many entries over a long period and I'm not sure where they'll be.
Are events such as user creation and deletion logged?
The amount of logging depends on what the administrator has chosen to audit over and above default logging.
Why don't you set up a Windows 2003 server in a virtual machine, then add and delete VPN users and see what is recorded in the logs by default? You will then hopefully have Event IDs, etc which you can use as filter fields in your case.
Thanks. I think I'll do that.
Event ID 630
Type Success Audit
Description User Account Deleted
Target Account Name %1 Target Domain %2
Target Account ID %3 Caller User Name %4
Caller Domain %5 Caller Logon ID %6
Privileges %7
Should be something like that…