Mastering Active Directory - Second Edition

Audit Directory Service Changes

This category records events related to AD DS object changes, such as the following:

• Create
• Delete
• Modify
• Move
• Undelete

When an object value is changed, it records the old value and the new value it was changed into. Again, the event will only be generated for the entries listed under SACL. Once auditing is enabled, the following events can be found under security logs:

Event ID	Event message
5136	A directory service object was modified.
5137	A directory service object was created.
5138	A directory service object was undeleted.
5139	A directory service object was moved.
5141	A directory service object was deleted.