ive looked through all the mods that have been done and there is nothing that could really stuff this up, but i found some things on the audit logs on the server
so ive included everything that it has from the login i used to add the account
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 1/01/2005
Time: 2:50:19 PM
User: JHOME\jamesas
Computer: CURLY
Description:
User Logoff:
User Name: jamesas
Domain: JHOME
Logon ID: (0x0,0x211B42)
Logon Type: 3
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 646
Date: 1/01/2005
Time: 2:50:18 PM
User: JHOME\jamesas
Computer: CURLY
Description:
Computer Account Changed:
-
Target Account Name: STINGER$
Target Domain: JHOME
Target Account ID: JHOME\STINGER$
Caller User Name: jamesas
Caller Domain: JHOME
Caller Logon ID: (0x0,0x211B42)
Privileges: -
Changed Attributes:
Sam Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: -
Account Expires: -
Primary Group ID: -
AllowedToDelegateTo: -
Old UAC Value: 0x80
New UAC Value: 0x81
User Account Control:
Account Disabled
User Parameters: -
Sid History: -
Logon Hours: -
DNS Host Name: -
Service Principal Names: -
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 629
Date: 1/01/2005
Time: 2:50:18 PM
User: JHOME\jamesas
Computer: CURLY
Description:
User Account Disabled:
Target Account Name: STINGER$
Target Domain: JHOME
Target Account ID: JHOME\STINGER$
Caller User Name: jamesas
Caller Domain: JHOME
Caller Logon ID: (0x0,0x211B42)
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 565
Date: 1/01/2005
Time: 2:50:18 PM
User: JHOME\jamesas
Computer: CURLY
Description:
Object Open:
Object Server: Security Account Manager
Object Type: SAM_DOMAIN
Object Name: DC=JHOME,DC=ath,DC=cx
Handle ID: 47271400
Operation ID: {0,2169795}
Process ID: 528
Process Name: C:\WINDOWS\system32\lsass.exe
Primary User Name: CURLY$
Primary Domain: JHOME
Primary Logon ID: (0x0,0x3E7)
Client User Name: jamesas
Client Domain: JHOME
Client Logon ID: (0x0,0x211B42)
Accesses: DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
ReadPasswordParameters
WritePasswordParameters
ReadOtherParameters
WriteOtherParameters
CreateUser
CreateGlobalGroup
CreateLocalGroup
GetLocalGroupMembership
ListAccounts
Privileges: -
Properties:
---
domain
DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
ReadPasswordParameters
WritePasswordParameters
ReadOtherParameters
WriteOtherParameters
CreateUser
CreateGlobalGroup
CreateLocalGroup
GetLocalGroupMembership
ListAccounts
Domain Password & Lockout Policies
lockOutObservationWindow
lockoutDuration
lockoutThreshold
maxPwdAge
minPwdAge
minPwdLength
pwdHistoryLength
pwdProperties
Other Domain Parameters (for use by SAM)
serverState
serverRole
modifiedCount
uASCompat
forceLogoff
domainReplica
oEMInformation
Domain Administer Server
Access Mask: 0
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 1/01/2005
Time: 2:50:18 PM
User: JHOME\jamesas
Computer: CURLY
Description:
User Logoff:
User Name: jamesas
Domain: JHOME
Logon ID: (0x0,0x211B8C)
Logon Type: 3
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 1/01/2005
Time: 2:50:18 PM
User: JHOME\jamesas
Computer: CURLY
Description:
Successful Network Logon:
User Name: jamesas
Domain: JHOME
Logon ID: (0x0,0x211B8C)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {b5971aae-3c83-4c93-27a7-551b90b7b6bf}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.0.21
Source Port: 1552
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
QUOTE
Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 576
Date: 1/01/2005
Time: 2:50:18 PM
User: JHOME\jamesas
Computer: CURLY
Description:
Special privileges assigned to new logon:
User Name: jamesas
Domain: JHOME
Logon ID: (0x0,0x211B8C)
Privileges: SeChangeNotifyPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.