1

How I could trigger Task Scheduler event when user mail field changed (or any custom attribute) in Active Directory? We want to run Powershell script when user mail field changes. Event ID: 4738, doesn't trigger when mail changed.

1

Event Id 4738 is logged for attributes that are documented for that event. If you want to use other attributes, you need to use Event Id 5136 (Directory Service Changes).

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738

2
  • I've tried Event ID 5136 but it doesn't trigger event either when I change user mail – Prefixas Nov 5 '20 at 18:11
  • @Prefixas: that's probably because you haven't enabled directory service change auditing. It isn't enabled by default. – Greg Askew Nov 5 '20 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.