4

My Active Directory forest has 6 child domains. As part of a security control, we are required to get alerted (e.g. using SCOM) when someone triggers a change in the domain name.

My question: Is there an event ID generated by Microsoft Windows 2008 when an Administrator performs a domain rename? I understand that for a server/computer rename, we can track it via Event ID 4742 or 6011, but would a domain rename share the same ID?

Improve this question
  • 1
    That's a pretty odd thing. a domain rename isn't a trivial operation. I'd think there'd be ample evidence of it occurring or being in process without having to scan the event logs. – joeqwerty Mar 5 '15 at 21:45
  • 1
    I won't disagree with you there Joe, but what I would like to see is that who performed this change, and event log is the best place to start in my mind. – Fahmy Aziz Mar 5 '15 at 21:55
3

As for seeing that a domain rename operation took place, yes.

Event ID: 1875
Level:    Warning
Source:   ActiveDirectory_DomainService
Log:      Directory Service
Active Directory Domain Services has detected that the replication 
epoch (as indicated by the msDS-ReplicationEpoch attribute of the following object) 
of the local domain controller has been changed. 
This typically occurs as part of the domain rename process. 

Object: 
CN=NTDS Settings,CN=CONTOSO01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Contoso,DC=com 
Old replication epoch: 
0 
New replication epoch: 
1  

As a result, replication between this domain controller and domain controllers 
that are using the old replication epoch is no longer allowed. Replication can 
occur only with those domain controllers using the new replication epoch.

Event ID: 1882
Level:    Information
Source:   ActiveDirectory_DomainService
Log:      Directory Service

Active Directory Domain Services is shutting down the system to 
complete the domain rename operation.

As for seeing who did it... that's a little trickier. Hopefully you don't have more than a small handful of people who could have done it. Basically, enable object access auditing via Group Policy and watch for changes to the DC=Domain,DC=com object.

Edit: Just wanted to clarify a little on that last part.

Use

repadmin /showobjmeta . "CN=NTDS Settings,CN=CONTOSO01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Contoso,DC=Com"

And if the attribute msDS-ReplicationEpoch has been changed, it will show you from what domain controller that change originated from (the "Originating DSA") and at what time. From there, you would need to inspect the Security logs on that originating DC to see who was logged on at that time.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.