Steps to find who enabled a user account using PowerShell

Perform the following actions on the domain controller (DC):

1. Click Start, search for WindowsPowerShell, right-click it, and select Run as administrator.
2. Type the following script into the console: Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4722} | Select-Object -Property *

3. Press Enter.
4. This script will display enabled user accounts. In the output, under Message → Subject → Account Name, the name and security ID of the user that enabled the target user account can be found.

Note: If you're using a workstation, the following script should be run on PowerShell:

Get-EventLog -LogName Security -ComputerName <DC name>| Where-Object {$_.EventID -eq 4722} | Select-Object -Property *

where <DC name> is the name of the domain controller where you want to check the details of the user account that was enabled.

Through native auditing, you can search for events and keep an eye on changes made to user objects. However, this becomes impractical when you have to deal with hundreds of user accounts and need to keep track of each event as it occurs.

ADAudit Plus is real-time Active Directory auditing software that helps gain visibility into the changes made to AD objects and their attributes. Monitor each phase in the life cycle of a user account along with details on who initiated it, from where, and when.