Archive for February, 2015

Who created a user object


Get-ADObject -Identity <ObjectIdentity> | Get-QADObjectSecurity -Owner





query your DCs for event id 624:

$filter = “LogFile=’Security’ AND EventCode=624 AND SourceName=’security’ AND CategoryString=’Account Management’ AND Message LIKE ‘%User Account Created%’ AND Type=’Audit Success'”
Get-WmiObject -Class Win32_NTLogEvent -Filter $filter -cn DC1,DC2 | Select-Object @{n=’UserName';e={$_.InsertionStrings[0]}},@{n=’Creator';e={$_.InsertionStrings[3]}}

block PST file creation and still allow Sharepoint and Internet Calendar creation


change the PST setting in the GPO from

No PST’s allowed to Allow Sharing-Exclusive PST files.

The you can’t create a PST file for email but you are able to add a Sharepoint calendar.


More info :

Go to Top