Mastering Active Directory

Audit Directory Service Access

This category records events when an AD DS object is accessed. This will only work if the system access control list (SACL) is configured and relevant objects have been added. This is similar to directory service access in legacy auditing.

SACL allows engineers to log access attempts to secured objects. SACL can generate audit records when an access attempt fails, when it succeeds, or both.

When auditing is enabled under this category, the following events can be found under security logs:

Event ID	Event message
4662	An operation was performed on an object