Event ID: 5139
A directory service object was moved.A directory service object was moved.
Subject:
Security ID: %3
Account Name: %4
Account Domain: %5
Logon ID: %6
Directory Service:
Name: %7
Type: %8
Object:
Old DN: %9
New DN: %10
GUID: %11
Class: %12
Operation:
Correlation ID: %1
Application Correlation ID: %2This event generates every time an Active Directory object is moved.
This event only generates if the destination object has a particular entry in its SACL: the “Create” action, auditing for specific classes or objects. An example is the “Create Computer objects” action, auditing for the organizational unit.
Auditing:
Conditional
Recommended if object-level auditing of Active Directory is required.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"
Operating Systems:
Windows 2008 Windows 2008 R2 Windows 2012 Windows 2012 R2 Windows 2016 Windows 2019 Windows 2022Tags:
Domain Controller Audit SuccessLEFT/RIGHT arrow keys for navigation
Back to List