Who joined a computer to a domain

Is there an easy way to determine what user account was used to join a computer to a domain?

Old post, but relevant question. The computer object will have an SID attached of which object created it. Use ADSIedit for this. Also, AD Audit Logging: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx

Look for Event ID 645 under the security event log on the local domain controllers. The event will include a username.

You must have event auditing configured to catch these events.

More info here: http://technet.microsoft.com/en-us/library/cc787268%28WS.10%29.aspx http://technet.microsoft.com/en-us/library/cc737542%28WS.10%29.aspx

Easy way might be to examine the logs on either the client computer that was joined to see who was logged in when the computer was joined, or the server serving as Primary Domain Controller.

If event auditing is enabled, you might also be able to see there.