Event ID: 5141

A directory service object was deleted.

A directory service object was deleted.

    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Directory Service:
    Name:   %7
    Type:   %8

    DN: %9
    GUID:   %10
    Class:  %11

    Tree Delete:    %12
    Correlation ID: %1
    Application Correlation ID: %2

This event generates every time an Active Directory object is deleted.

This event only generates if the deleted object has a particular entry in its SACL: the “Delete” action, auditing for specific objects.

Auditing:     Conditional

Recommended if object-level auditing of Active Directory is required.

Microsoft Documentation

Event ID - 5141

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"

LEFT/RIGHT arrow keys for navigation

Back to List