Event ID: 5139A directory service object was moved.
A directory service object was moved. Subject: Security ID: %3 Account Name: %4 Account Domain: %5 Logon ID: %6 Directory Service: Name: %7 Type: %8 Object: Old DN: %9 New DN: %10 GUID: %11 Class: %12 Operation: Correlation ID: %1 Application Correlation ID: %2
This event generates every time an Active Directory object is moved.
This event only generates if the destination object has a particular entry in its SACL: the “Create” action, auditing for specific classes or objects. An example is the “Create Computer objects” action, auditing for the organizational unit.
Recommended if object-level auditing of Active Directory is required.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"
LEFT/RIGHT arrow keys for navigationBack to List