Event ID 5136

A directory service object was modified

A directory service object was modified.

Subject:
    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:           %6

Directory Service:
    Name:   %7
    Type:   %8

Object:
    DN:     %9
    GUID:   %10
    Class:  %11

Attribute:
    LDAP Display Name:  %12
    Syntax (OID):       %13
    Value:              %14

Operation:
    Type:                       %15
    Correlation ID:             %1
    Application Correlation ID: %2


Syntax (OID) [Type = UnicodeString]: The syntax for an attribute defines the storage representation, byte ordering, and matching rules for comparisons of property types. Whether the attribute value must be a string, a number, or a unit of time is also defined. Every attribute of every object is associated with exactly one syntax. The syntaxes are not represented as objects in the schema, but they are programmed to be understood by Active Directory. The allowable syntaxes in Active Directory are predefined.

Auditing:     Conditional

Recommended if object-level auditing of Active Directory is required.


Generates every time an Active Directory object is modified.


Microsoft Documentation

Event ID - 5136



NameFieldInsertion StringOSExample
Correlation IDOpCorrelationID%1Any {02647639-8626-43CE-AFE6-7AA1AD657739}
Application Correlation IDAppCorrelationID%2Any -
Security IDSubjectUserSid%3Any ORG\UserA
Account NameSubjectUserName %4Any UserA
Domain NameSubjectDomainName%5Any ORG
Logon IDSubjectLogonId%6Any 0x432344
NameDSName%7Any org.local
TypeDSType%8Any Active Directory Domain Services
DNObjectDN%9Any CN=users,CN=Builtin,DC=org,DC=local
GUIDObjectGUID%10Any CN=users,CN=Builtin,DC=org,DC=local
ClassObjectClass%11Any user
LDAP Display NameAttributeLDAPDisplayName%12Any userAccountControl
Syntax (OID)AttributeSyntaxOID%13Any View Codes
ValueAttributeValue%14Any 512
TypeOperationType%15Any Value Deleted

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"
How to enable Windows Auditing
Recommended Audit Policy

Operating Systems:
Windows VistaWindows 2008Windows 2008 R2Windows 7Windows 2012Windows 2012 R2Windows 8Windows 8.1Windows 10Windows 11Windows 2016Windows 2019Windows 2022Windows 2025

Tags:
Domain ControllerAudit Success
Audit Category:
DS Access

Audit Subcategory:
Directory Service Changes
Legacy Events:
566

Correlated Events:
4624

LEFT/RIGHT arrow keys for navigation

Back to List