How to search for "User" objects deleted events in Active Directory? (4320039)

A "User Deleted" Event Class does not exist in the Event Class selector of the search properties, this is because of Active Directory objects Tombstone lifetime. The objects are not actually deleted, they are only "Removed" or hidden from Active Directory until the Tombstone Lifetime period expires. Consequently the relevant event class for this event is "User object removed".

Complete the following to create the search:

1. Click “New” bottom in the button-bar menu to create a new search (save it as any desired name)
2. Select the “What” tab in the search properties (search properties must be visible)
3. Click the “Plus” or “Add” button in the button-bar of the search properties
4. Search for or add a keyword in the “Event Class Filter for “User object removed”
5. Click the “Add” button to move the selected Event Class to the Parameter section below and click “OK”

Save and run report.