MsecureKB - Microsoft Security & Identity Forum

Provide a Microsoft Security & Identity Support, Troubleshooting, and more
 
HomeHome  FAQFAQ  RegisterRegister  Log inLog in  

Share | 
 

 Domain admins group were removed in very strange way

View previous topic View next topic Go down 
AuthorMessage
thomas jeferson



Posts : 1
Points : 3

PostSubject: Domain admins group were removed in very strange way   Sun Aug 24, 2014 3:17 pm

Hiya’ll
I stand with Windows Server 2003 Native AD mode.
In This days our members of the Domain admins group were removed in very strange way and leaving the group empty.
When i checked the event log :
A member was removed from a security-enabled global group
Subject:

Security ID: SYSTEM
Account Name: WIN81-WS$
Account Domain: GovSecLAB
Logon ID: 0x4d2dce56
Member:
Security ID: GovSecLAB\sample
Group:
Security ID: GovSecLAB\Domain Admins
Group Name: Domain Admins
Group Domain: GovSecLAB
Additional Information:
Privileges: -

This is very important
Help please!!

thanks Thomas

Back to top Go down
shuki
Admin
avatar

Posts : 43
Points : 58

PostSubject: Re: Domain admins group were removed in very strange way   Sun Aug 24, 2014 3:39 pm

Hey Thomas
Thanks for posting,


According to event log
4729 A member was removed from a security-enabled global group.

From the event log it’s user WIN81-WS who initiated the action to remove members from Domain Admins group.
You must check if WIN81-WS did this by a mistake.

Back to top Go down
http://msecurekb.forumv.biz
 
Domain admins group were removed in very strange way
View previous topic View next topic Back to top 
Page 1 of 1
 Similar topics
-
» Abs removed-1986 K100rs
» Strange chunk of metal, has NO effect on detector, what is it?
» domain name and home page
» Group buy on Russell Day Long seats
» Forget the Yahoo group, this is where the A100's meet!

Permissions in this forum:You cannot reply to topics in this forum
MsecureKB - Microsoft Security & Identity Forum :: Active Directory :: Permissions | Delegation | SPN-
Jump to: