user accounts are reappearing

[tony]

I have a windows 2000 AD setup up, however we still have
2 NT4 DC's on the domain. I can verify that replication
betwene all 2000's dc's is running fine and no servers
have been off the network for more than 5 min for a
reboot over the last 2 years. For some reason user
accounts that have been deleted years ago are reappearing
and I don't know what's causing it. I verified
everything in this MS article

http://support.microsoft.com/default.aspx?scid=kb;en-
us;314282&Product=win2000

Could it be the NT dc's. If not is there a tool to
monitor who creates/deletes an id and when?

 

[Tim Hines [MSFT]]

You can perform auditing to determine who may be creating accounts. There
is a policy setting called "audit account management" that you can enable.
The description of the setting is below.

Audit account management
Computer Configuration\Windows Settings\Security Settings\Local
Policies\Audit Policy

Description
Determines whether to audit each event of account management on a computer.
Examples of account managment events include:

a.. A user account or group is created, changed, or deleted
b.. A user account is renamed, disabled, or enabled
c.. A password is set or changed
By default, this value is set to No auditing in the Default Domain
Controller Group Policy object (GPO) and in the local policies of
workstations and servers.

If you define this policy setting, you can specify whether to audit
successes, audit failures, or not to audit the event type at all. Success
audits generate an audit entry when any account management event is
successful. Failure audits generate an audit entry when any account
management event fails. You can select No auditing by defining the policy
setting and unchecking Success and Failure.


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.