Computer Account Deleted Automatically

My one Computer Account Deleted Automatically from active directory, when i
tried to loging it gives me the msg that no computer account found on
database of server.

Please tell me how to check that how did that account deleted what should be
the precautions to be taken for future to prevent it.

Accounts wan't delete themself in AD, also AD didn't remove them automatic.
To find the account that has deleted it you have to enable auditing on the
domain controllers OU with GPO.

Under computer configuration, windows settings, security settings, local
policies, audit policy enable "Audit account management" for success and
failure.

Here you will have a good overview over event id's that are logged:

Choose "Account mamagement" and you will see event id 647 for 2000/2003 and
4743 2008 for "Computer account deleted"

Please post also the complete error message you get. Maybe there exist some
problem related to AD. How many DCs do you have in the domain and how are
they located?

Weird it should not be deleteled autmatically if its in use.
Did u happened to check it in the ADUC ?? what is the exact error you
are receiving ?

Yes iam also really concerned about it as i have migrated our old dc from
windows server 2000 to windows server 2008 last 15 days back and the machine
wich was unable to be loging was also new and I installed windows server 2008
Ent around 10 days back and our applications were running on it properlly i
just install a backup software on it it required the restart then I failed to
login the machine the coz it production invironment and my applications were
down I rejoined it to domain by going on to workgroup through local admin
account then again joined the domain and turned on all the applications on
it, but its really critical for me as it wont happing to any other machine in
my network I want to ensure that my AD is fine , further iam also working
with AD invornment since long but i never seen computer account vanishining
like this then i also checked that the DNS A record is also present in it.

Chekc your DCs with dcdiag /v, netdiag and repadmin /showrepl to check for
existing errors.

[Haynsey]

Sorry for jumping into this thread with my own problem albeit very similar to the OP's so I hope I can add something to it. If someone has an issue I will create a new thread no worries.

We run a single 2003 native domain with 6 DC's. All clients are XP SP2. I inherited this domain so I cannot speculate on how its initial setup was done.

The issue we are experiencing is that random workstation accounts are being deleted from AD and we don't know why. It occurs roughly once a fortnight, it has not affected a server account yet and I believe it is only occuring on computer accounts that are sitting inside one of AD's OU's (We have multiple sites so depending on their site, computers are organized into a particular OU) but I will need to confirm this with my counterparts.

When the account is deleted, the workstation is not able to be used on the domain. On logon, it says that the domian is unnavailable or the account was deleted. Checking inside AD, you can verify the account no longer exists.

I have enabled auditing on all 6 DC's. When the account is deleted, I go through and check the last 24 hours but there is no mention of event ID 647. I have also checked scheduled tasks that other admin's may have enabled are there is nothing I found running against AD. I would assume if a script was deleting these accounts, event ID 647 would pop up.

Google is not being cooperative either.

I will be running dcdiag on all DC's throughout the day user requests permitting.

Is there another way I can find out how these accounts are being deleted?
Is there something I'm missing?

I have created a new thread. Please see it here:- AD Computer Accounts being Deleted Randomly

I have replied to your message in the linked thread.

As this posting is already from 08/2009 it is always better to create a new
one. Anyway, as stated in the beginning for the OP, a computer account will
NOT be deleted automatically, except some scripts are trigger this.

What auditing settings in detail have you set on the domain controllers OU?

I'm not sure which thread to reply to. Since this is the fresh one, I would
think to reply to this.

First, let's see an ipconfig of a sample DC and a sample workstation or one
that this has occured on.

Also, Event logs - any errors, please post the EventID# and source names on
the DCs and/or workstations.

Any restrictions configured in a GPO on that OU?