if someone logged onto a server (A) with active directory authenticating through domain controller (B) and some accounts get deleted from active directory (A). which event logs from which server will show this deletion. suffice to say there are logs on server A and i suppose but not sure that there will also be logs on server B to show when authentication took place.
Thanks
The answer really depends on what level of logging is enabled. It also depends on how server A is setup (ie is it replicating AD, is it just a member server, etc).
Really need more info to give anything more than a supposition.
server A i is replicating AD and not just a member server. by logs.. i am talking of activity logs of whatever activities have been carried out on server A with AD. server B is only a domain controller
Mike,
Bithead's response still applies.
In order to log account mgmt activities, DCs need to be configured to do so. If they are, you will see this activity in the Event Logs…I have used these logs in examinations previously.