Return
-
Title
How to find out who restored objects -
Description
Accounts were restored and need to find out who restored what objects. -
Resolution
When objects are restored the details are stored in the Application event log on the Recovery Manager server they are written to the Application event log under the source "Recovery Manager for AD" using event ID's 1560 and 1561, (event ID 1561 contains information about what object was restored).
More information around the event ID's can be found on page 171 of the User Guide. If the application event log has rolled over since the restore then a tool such as Change Auditor will need to be used to track historical changes.