Tracing down user and computer account deletion in Active Directory

  In order to find out about user and computer account deletion, you must keep the “Account Management” auditing enabled, beforehand. The Account Management auditing needs to be enabled as follows: At Domain Controller OU level, edit the “Default Domain Controller” policy to enable auditing: Computer configuration > Windows settings > Security settings > Local…

32