Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to know, who (usersid or loginname) changed a specified GPO for a specified OU in the Active Directory. Given our audit settings include this, what would be the right Event ID to look for?

share|improve this question
up vote 4 down vote accepted

On Windows Server 2008, it is event ID 5136 (Directory Service Changes). See also event IDs 5137 (create), 5138 (undelete), 5130 (move). Event ID 4662 contains the old-style audit event (see below).

On Windows 2000 Server and Windows Server 2003:

[T]he policy Audit directory service access was the only auditing control available for Active Directory. The events that were generated by this control did not show the old and new values of any modifications. This setting generated audit events in the Security log with the ID number 566. In Windows Server 2008, the audit policy subcategory Directory Service Access still generates the same events, but the event ID number is changed to 4662.

share|improve this answer
Unfortunately it's not 2008 ... if I look for Event ID 566 ... the "Object Type" in the message should be {f30e3bc2-9ff0-11d1-b603-0000f80367c1}, right? – Hinek Feb 22 '10 at 10:23
Object Type will be something like user or computer. – shufler Feb 22 '10 at 18:18

we can see this article to know about event ID 5136 .. it explains how to map old value and new value event

share|improve this answer
Please summarize the article that you linked, quoting any relevant code segments or configuration blocks. Sites can change in the future or fail to load for any number of reasons. – tristan Nov 27 '13 at 14:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.