A client of mine is experiencing a strange issue, and I have been unable to find any resources to help me resolve it. She has several accounts that she has disabled, which are somehow getting reactivated after a certain period of time. I checked for any option which may have set them to be just temporarily disabled, but couldn't find anything. This doesn't happen with all disabled accounts, and neither of us have been able to find any differences between the ones that re-enable and the ones that don't. Any ideas??

Other admins? If more than one domain controller, verify replication between them.

A couple of ideas: 1. Ensure auditing is turned on. The audit information should be able to tell you information about who, when, from where, etc.? 2. Look at the object metadata using repadmin for the accounts that keep being re-set. That should tell you the time the change was made and the DCwhichmade the change. 3. Any synchronisation with other systems that could be causing this, e.g. MIIS, eDirectory, etc? Tony