It is tough to do after the fact if you don't have auditing enabled. Your one
chance is by looking at the ACL for any telltale ACES and look at the owner
listed on the SD. If the user had admin rights in the domain this won't work
because it will say administrators.
Ask a Question
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.