Mastering Active Directory

Audit Directory Service Changes

This category records events related to AD DS object changes such as:

• Create
• Delete
• Modify
• Move
• Undelete

When an object value is changed, it records the old value and the new value it was changed into. Again, the event will only be generated for the entries listed under SAC. Once auditing is enabled, the following events can be found under security logs:

Event ID	Event message
5136	A directory service object was modified
5137	A directory service object was created
5138	A directory service object was undeleted
5139	A directory service object was moved
5141	A directory service object was deleted