Ziemek Borowski na pl.comp.os.ms-windows.winnt:
> Kiedy to dość prosto. dsa.msc -> advanced -> properites maszyny ->
> zakładka object. Czyli atrybut createTimeStamp i whenCreated
> Kto... Gorzej. event log pozostaje.
Oczywiście zapomniałem o evencie:
Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 646
Date: 2005-06-08
Time: 06:05:05
User: JAKASDOMENA\administrator
Computer: ADCGDY01
Description:
Computer Account Changed:
-
Target Account Name: QWE$
Target Domain: JAKASDOMENA
Target Account ID: JAKASDOMENA\QWE$
Caller User Name: Administrator
Caller Domain: JAKASDOMENA
Caller Logon ID: (0x0,0x243BF7)
Privileges: -
Changed Attributes:
Sam Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: -
Account Expires: -
Primary Group ID: -
AllowedToDelegateTo: -
Old UAC Value: -
New UAC Value: -
User Account Control: -
User Parameters: -
Sid History: -
Logon Hours: -
DNS Host Name: qwe.jakasdomena.pl
Service Principal Names:
HOST/qwe.jakasdomena.pl
HOST/QWE
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-- ZiemekReceived on Wed Jun 8 07:05:22 2005
To archiwum zostało wygenerowane przez hypermail 2.1.8 : Wed 08 Jun 2005 - 07:42:02 MET DST