I had an old user account that has long since been deleted and was wondering if there is a way to see when that account awas created and deleted. Would it be somewhere in the events log? Somewhere else?
I had an old user account that has long since been deleted and was wondering if there is a way to see when that account awas created and deleted. Would it be somewhere in the events log? Somewhere else?
Hello,
Are you talking about a system user account ? If so which OS is concerned ?
If it's related to the accounts on the server then there are accounting logs which will provide the details of when the account was created and deleted.
/var/log/account/pacct
If auditing is enable you can track the same by checking the event log.In order to find out changes, creation or deletion events, you must keep the “Account Management” auditing enabled..You cal also use repadmin /showobjmeta to trace the same.
If it is related to Wordpress then a log file is created where all archival information are stored
The user and logon session that performed the action.
Security ID: The SID of the account.
Account Name: The account logon name.
Account Domain: The domain or - in the case of local accounts - computer name.
Logon ID is a semi-unique (unique between reboots) number that identifies the logon session. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.