- Run gpmc.msc → edit "Default Domain Policy" → Computer Configuration → Policies → Windows Settings → Security Settings:
- Local Policies → Audit Policy → Audit account management → Define → Success
- Event Log → Define → Maximum security log size to 1gb and Retention method for security log to Overwrite events as needed.
- Open ADSI Edit → Connect to Default naming context → right click "DC=domain name" → Properties → Security (Tab) → Advanced → Auditing (Tab) → Click "Add" → Choose the following settings:
- Principal: Everyone; Type: Success; Applies to: This object and all descendant objects; Permissions: Delete, Delete subtree, Write all properties → Click "OK".
- To define what computer account was deleted filter Security Event Log for Event ID 4743.

- Run Netwrix Auditor → Navigate to "Search" → Click on "Advanced mode" if not selected → Set up the following filters:
- Filter = "Data source"
Operator = "Equals"
Value = "Active Directory" - Filter = "Object type"
Operator = "Equals"
Value = "Computer" - Filter = "Action"
Operator = "Equals"
Value = "Removed"
- Filter = "Data source"
- Click the "Search" button and review who deleted computer accounts.
