Hi im currently investigating about a account what was removed and recreated in active directory. I was able to confirm that the account was recreted because the whenCreated value of the account in question is just recent, while this employee was hired months ago.
Is there any way to trace who created the active directory account?