Given that you created it manually and you had auditing turned on, you
should be able to look for 626 or something in the 600 range under the
"account management" category in you security log under the admin user
account that created the account. It depends on how you long your logs go
back. If you have multiple log files you might want to find a script of
sorts that possibly does it. I dont think accinfo.dll gives you that info,
just the last logon times.

Greg

----- Original Message -----
From: "Lee Clemens" <lee (at) leeclemens (dot) net [email concealed]>
To: <focus-ms (at) securityfocus (dot) com [email concealed]>
Sent: Wednesday, August 23, 2006 11:25 AM
Subject: User creation audit trail

> Hello all,
>
> I am trying to find a way to verify and when and by whom a user was
> created
> on a Domain computer. The account was created on the local machine, so I'm
> wondering if it is captured in the event log somewhere. And perhaps what
> the
> event ID is for that, or anywhere else I could find out??
>
> Thanks in advance,
> Lee Clemens
>
>
>
> ------------------------------------------------------------------------
---
> ------------------------------------------------------------------------
---
>
>

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]