Is there a report that distinguishes between enabling and disabling accounts? (NETIQKB22717)

goal
Is there a report that distinguishes between enabling and disabling accounts?

fact
Directory and Resource Administrator 6.x

fact
Directory and Resource Administrator 7.x

fact
Enterprise Administrator 5.00.02

fix

The application log event generated by Enterprise Administrator or Directory and Resource Administrator only details that a Disable/enable operation took place.  This is done for performance reasons because it would be overwhelming for the reporting process if the product had to parse the contents of the description field for each event.   Another product such as Security Manager can be used to parse thru the description field to determine if the account was disabled or enabled. 

The next release of DRA (version 8.0) now writes specific Event Log entries for each Enable or Disable operation.   

note

• In EA, the event id 7063 is returned when a user account is enabled or disabled, but there is nothing that tell you whether the flag was set to disabled or enabled in EA.
• In DRA, the event id 16020 is returned when a user account is enabled or disabled, but there is nothing that tell you whether the flag was set to disabled or enabled in DRA

The DRA event is:

Source          MCSAdminSvc
Category      UserSetInfo
Type             Success
Event ID       16020
Action           SetInfo
ObjectType  User
Operands     Account Disabled

Formerly known as NETIQKB22717