Скачать или смотреть How to find who Deleted a User Account in Active Directory

How to Find Who Deleted a User Account in Active Directory
===========================================================================
$Computers = Get-ADComputer -SearchBase 'OU=Domain Controllers,DC=karnav,DC=lan' -Filter * | Select-Object -ExpandProperty Name
$LogName = 'Security'
$FilterXPath = "*[System[(EventID=4726)]]" # Example: Filter for failed login attempts
ForEach ($Computer in $Computers) {
Try {
Get-WinEvent -ComputerName $Computer -LogName $LogName -FilterXPath $FilterXPath -ErrorAction Stop | Select-Object TimeCreated, Id, LevelDisplayName, Message, MachineName, LogName
}
Catch {
Write-Warning "Could not retrieve events from $Computer $($_.Exception.Message)"
}
} =======================================================================
repadmin /showobjmeta INDEDC01 "CN=Pankaj,OU=Users,OU=HR,DC=karnav,DC=lan"