2

I know how to check what GPOs are applied on systems and users, but I'm wondering, is there a way to check who applied a specific GPO?

1 Answer 1

3

Meaning which admin set a GPO in the GPMC? You can with auditing, using tools like Netwrix or similar, or you can if you deploy the AGPM (https://technet.microsoft.com/en-us/windows/hh826067). You can also make sure DS auditing is enabled and look on the DC the change was made to (good luck!) and find event 566 I believe.

Personally, I like the 3rd party tool above, but it is expensive so it's for a larger shop. If you only have a few DCs you could setup something to alert you for event 566 entries on those DCs which would likely suffice.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .