Event ID: 5139

A directory service object was moved.

A directory service object was moved.

    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Directory Service:
    Name:       %7
    Type:       %8

    Old DN:     %9
    New DN: %10
    GUID:       %11
    Class:      %12

    Correlation ID:         %1
    Application Correlation ID: %2

This event generates every time an Active Directory object is moved.

This event only generates if the destination object has a particular entry in its SACL: the “Create” action, auditing for specific classes or objects. An example is the “Create Computer objects” action, auditing for the organizational unit.

Auditing:     Conditional

Recommended if object-level auditing of Active Directory is required.

Microsoft Documentation

Event ID - 5139

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"

LEFT/RIGHT arrow keys for navigation

Back to List