Event ID: 5136

A directory service object was modified

A directory service object was modified.

Subject:
    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:           %6

Directory Service:
    Name:   %7
    Type:   %8

Object:
    DN:     %9
    GUID:   %10
    Class:  %11

Attribute:
    LDAP Display Name:  %12
    Syntax (OID):       %13
    Value:              %14

Operation:
    Type:                       %15
    Correlation ID:             %1
    Application Correlation ID: %2

Syntax (OID) [Type = UnicodeString]: The syntax for an attribute defines the storage representation, byte ordering, and matching rules for comparisons of property types. Whether the attribute value must be a string, a number, or a unit of time is also defined. Every attribute of every object is associated with exactly one syntax. The syntaxes are not represented as objects in the schema, but they are programmed to be understood by Active Directory. The allowable syntaxes in Active Directory are predefined.

Auditing: Conditional

Recommended if object-level auditing of Active Directory is required.

Generates every time an Active Directory object is modified.

Microsoft Documentation

Event ID - 5136

	Field	Insertion String	OS	Example
Correlation ID	OpCorrelationID	%1	Any	{02647639-8626-43CE-AFE6-7AA1AD657739}
Application Correlation ID	AppCorrelationID	%2	Any	-
Security ID	SubjectUserSid	%3	Any	ORG\UserA
Account Name	SubjectUserName	%4	Any	UserA
Domain Name	SubjectDomainName	%5	Any	ORG
Logon ID	SubjectLogonId	%6	Any	0x432344
Name	DSName	%7	Any	org.local
Type	DSType	%8	Any	Active Directory Domain Services
DN	ObjectDN	%9	Any	CN=users,CN=Builtin,DC=org,DC=local
GUID	ObjectGUID	%10	Any	CN=users,CN=Builtin,DC=org,DC=local
Class	ObjectClass	%11	Any	user
LDAP Display Name	AttributeLDAPDisplayName	%12	Any	userAccountControl
Syntax (OID)	AttributeSyntaxOID	%13	Any	View Codes
Value	AttributeValue	%14	Any	512
Type	OperationType	%15	Any	Value Deleted

Lookup Audit Policy Configuration Settings


  C:\> AuditPol.exe /get  /subcategory:"Directory Service Changes"

How to enable Windows Auditing

Recommended Audit Policy

Operating Systems:

Windows Vista Windows 2008 Windows 7 Windows 2008 R2 Windows 8 Windows 2012 Windows 8.1 Windows 2012 R2 Windows 10 Windows 2016 Windows 2019 Windows 11 Windows 2022

Tags:

Domain Controller Audit Success

Audit Category:

DS Access

Audit Subcategory:

Directory Service Changes

Legacy Events:

566

Correlated Events:

4624

LEFT/RIGHT arrow keys for navigation

Back to List