Event ID: 5141
A directory service object was deleted.A directory service object was deleted.
Subject:
Security ID: %3
Account Name: %4
Account Domain: %5
Logon ID: %6
Directory Service:
Name: %7
Type: %8
Object:
DN: %9
GUID: %10
Class: %11
Operation:
Tree Delete: %12
Correlation ID: %1
Application Correlation ID: %2This event generates every time an Active Directory object is deleted.
This event only generates if the deleted object has a particular entry in its SACL: the “Delete” action, auditing for specific objects.
Auditing:
Conditional
Recommended if object-level auditing of Active Directory is required.
Microsoft Documentation
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"
Operating Systems:
Windows 2008 Windows 2008 R2 Windows 2012 Windows 2012 R2 Windows 2016 Windows 2019 Windows 2022Tags:
Domain Controller Audit SuccessLEFT/RIGHT arrow keys for navigation
Back to List