question

sureshsundaram-8222 avatar image
0 Votes"
sureshsundaram-8222 asked DSPatrick answered

Event ID for Machine went out of domain

Have more than 4000 Desktop PCs in our environment. There are some machines going out of domain by automatically. Would like to get to know the Event ID when machine going out by automatically. It will be helpful to trace the machines through Splunk( Event Log)

windows-server
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.


Hi,
 
Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

0 Votes 0 ·

If there are any updates, welcome to share here!

Best Regards,

0 Votes 0 ·
DSPatrick avatar image
0 Votes"
DSPatrick answered DSPatrick edited

Possibly netlogon source events in the System event log of IDs 5719, 5722 or 5723
https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/secure-channel-problems-detected


You could do nltest /sc_query:domainname to check

--please don't forget to Accept as answer if the reply is helpful--





5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered

Hi,

It is suggested to enable the audit policies on DCs.
The policy: Audit computer account management is under Computer Configuration\Windows Settings\Security Settings\Advanced audit policy\ Account management\Audit Computer account management
100411-5282.jpg
This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted.

Best Regards,


5282.jpg (73.8 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick avatar image
0 Votes"
DSPatrick answered

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--






5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.