admin管理员组

文章数量:1313735

We have an AD environment with 10+ domain controllers. The behavior that we're observing is that after an AD user account is created and we observe the 4720 Account Created event, it's followed shortly after by a 4726 Account Deleted event despite the account never being deleted and is still active in AD.

Has anyone else ever noticed this in a distributed AD environment. My first impression is that it might possibly have something to do with the AD controllers syncing, but I'm not sure why the process would spawn a 4726 event when the account was never actually deleted.

As of now we haven't tried anything to remediate this issue from occurring since we don't understand why this is happening.

本文标签: