Event ID: 5141

A directory service object was deleted.

A directory service object was deleted.

Subject:
    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Directory Service:
    Name:   %7
    Type:   %8

Object:
    DN: %9
    GUID:   %10
    Class:  %11

Operation:
    Tree Delete:    %12
    Correlation ID: %1
    Application Correlation ID: %2
Microsoft Documentation

Event ID - 5141



This event generates every time an Active Directory object is deleted.

This event only generates if the deleted object has a particular entry in its SACL: the “Delete” action, auditing for specific objects.



Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"
How to enable Windows Auditing



LEFT/RIGHT arrow keys for navigation

Back to List