Active Directory: How to Detect Who Disabled a User Account

  • Article

Why It Is Important

If a user can’t log into IT systems with Windows authentication, one of the reasons behind could be an accidentally performed change to system configuration. An incorrect change to system configuration can accidentally disable a user in Active Directory. Disabled users in Active Directory may be unable to access critical resources such as email, files and SharePoint, disrupting the seamless flow of operations. Therefore, IT pros need to be able to detect when accounts are disabled and quickly determine who made the changes that resulted in Active Directory disabled account.

Native Auditing

  1. Run gpedit.msc → Create a new GPO → Edit it → Go to "Computer Configuration" → Policies → Windows Settings → Security Settings → Local Policies > Audit Policy:

    • Audit account management → Define → Success.

  2. Go to Event Log → Define:

    • Maximum security log size to 4GB
    • Retention method for security log to Overwrite events as needed.

  3. Link the new GPO to OU with User Accounts → Go to "Group Policy Management" → Right-click the defined OU → Choose "Link an Existing GPO" → Choose the GPO that you’ve created.

  4. Force the group policy update → In "Group Policy Management" → Right-click the defined OU → Click "Group Policy Update".

  5. Open ADSI Edit → Connect to Default naming context → Right-click DomainDNS object with the name of your domain → Properties → Security (Tab) → Advanced (Button) → Auditing (Tab) → Add Principal "Everyone" → Type "Success" → Applies to "This object and Descendant objects" → Permissions → Select all check boxes except the following:

    1. Full Control
    2. List Contents
    3. Read all properties
    4. Read permissions > Click "OK".

  6. Open Event Viewer and search Security log for event ID’s 4725 (User Account Management task category).

    https://img.netwrix.com/landings/howtofriday/24/NA.png

Real Life Use Case Video

View

Credits:

Originally posted - https://www.netwrix.com/how_to_monitor_who_disabled_user_account.html