User accounts in AD being modified - but how? HELP NEEDED!

[kennysarmy]

Hi,

 

We are getting 2 or 3 students a week coming to us not able to logon.

 

When we check their details in Active Directory Accoutn Tab the User logon name (Pre windows 2000) has been amended to include an additional two leading zeros.

 

 

We are running sims.net and our VLE is moodle managed by webanywhere with a sims integrator installed.

 

Windows DC's are 2008 R2.

 

Will there be any logs of how these students details are being edited or can I turn on some logging to ascertain what is going on....

 

I don't want to come in one morning and find no students can logon

 

[mthomas08]

Not much help but you can add a column of modified in to AD which might help you narrow down the time it was last modified?

 

Never seen this one happen before though.

[Michael]

I've not seen this before either. Is there a minimum username length in 2008 R2?

 

Are you running 2008 R2 with SP1?

 

Is SIMS integrated with your Active Directory? And is your VLE using LDAP, again using your Active Directory?

[kennysarmy]

There is no link between SIMS and AD.

 

Yes the VLE (moodle) uses LDAP so that single sign on is possible within school - I've emailed them to find out if there is any write-back to AD feature....

[bio]

I would start out with enabling AD object auditing....to find out which user(or service account) is modifing things.

HOW TO: Audit Active Directory Objects in Windows Server 2003

 

bio..