This category records events related to AD DS object changes such as:
- Create
- Delete
- Modify
- Move
- Undelete
When an object value is changed, it records the old value and the new value it was changed into. Again, the event will only be generated for the entries listed under SAC. Once auditing is enabled, the following events can be found under security logs:
|
Event ID |
Event message |
|
5136 |
A directory service object was modified |
|
5137 |
A directory service object was created |
|
5138 |
A directory service object was undeleted |
|
5139 |
A directory service object was moved |
|
5141 |
A directory service object was deleted |