Event ID: 5137

A directory service object was created

A directory service object was created.

Subject:
    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:           %6

Directory Service:
    Name:   %7
    Type:   %8

Object:
    DN:     %9
    GUID:   %10
    Class:  %11

Operation:
    Correlation ID:             %1
    Application Correlation ID: %2


Auditing:     Conditional

Recommended if object-level auditing of Active Directory is required.


Generates every time an Active Directory object is created.


Microsoft Documentation

Event ID - 5137



Name Field Insertion String OS Example
Correlation ID OpCorrelationID %1 Any {02647639-8626-43CE-AFE6-7AA1AD657739}
Application Correlation ID AppCorrelationID %2 Any -
Security ID SubjectUserSid %3 Any ORG\IserA
Account Name SubjectUserName %4 Any UserA
Domain Name SubjectDomainName %5 Any ORG
Logon ID SubjectLogonId %6 Any 0x432344
Name DSName %7 Any org.local
Type DSType %8 Any Active Directory Domain Services
DN ObjectDN %9 Any CN=Win2003,CN=Users,DC=org,DC=local
GUID ObjectGUID %10 Any CN=Win2003,CN=Users,DC=org,DC=local
Class ObjectClass %11 Any computer


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"



LEFT/RIGHT arrow keys for navigation

Back to List