Steps to find who deleted computer accounts using PowerShell:

Perform the following actions on the domain controller (DC):

1. Click Start, search for Windows PowerShell, right-click it, and select Run as administrator.
2. Type the following script into the console:

   Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4743} | Select-Object -Property *

3. Press Enter.
4. This script will display deleted user accounts. In the output, under Message > Subject > Account Name, the name and security ID of the user that performed the deletion on the target computer account can be found.

Note: If you are using a workstation, the following script should be run on PowerShell:

Get-EventLog -LogName Security -ComputerName <DC name>| Where-Object {$_.EventID -eq 4743} | Select-Object -Property *

where <DC name> is the name of the domain controller where you want to check the details of the deletion that took place.

Through native auditing, you can search for events to keep an eye on object deletions. However, this becomes impractical when you have to deal with thousands of computer accounts, and need to keep track of each event as it occurs.

The above process can be simplified by using ADAudit Plus, real-time Active Directory auditing software. ADAudit Plus provides detailed information on who deleted what, when, and from where for every AD change event occurring in your organization, including computer management.