Is there a report that distinguishes between enabling and disabling accounts?
Directory and Resource Administrator 6.x
Directory and Resource Administrator 7.x
Enterprise Administrator 5.00.02
The application log event generated by Enterprise Administrator or Directory and Resource Administrator only details that a Disable/enable operation took place. This is done for performance reasons because it would be overwhelming for the reporting process if the product had to parse the contents of the description field for each event. Another product such as Security Manager can be used to parse thru the description field to determine if the account was disabled or enabled.
The next release of DRA (version 8.0) now writes specific Event Log entries for each Enable or Disable operation.
- In EA, the event id 7063 is returned when a user account is enabled or disabled, but there is nothing that tell you whether the flag was set to disabled or enabled in EA.
- In DRA, the event id 16020 is returned when a user account is enabled or disabled, but there is nothing that tell you whether the flag was set to disabled or enabled in DRA
The DRA event is:
Event ID 16020
Operands Account Disabled