Security Event ID 5141 - A directory service object was deleted.

Event ID 5141

A directory service object was deleted.

A directory service object was deleted.

Subject:
    Security ID:        %3
    Account Name:       %4
    Account Domain:     %5
    Logon ID:       %6

Directory Service:
    Name:   %7
    Type:   %8

Object:
    DN: %9
    GUID:   %10
    Class:  %11

Operation:
    Tree Delete:    %12
    Correlation ID: %1
    Application Correlation ID: %2

This event generates every time an Active Directory object is deleted.

This event only generates if the deleted object has a particular entry in its SACL: the “Delete” action, auditing for specific objects.

Auditing: Conditional

Recommended if object-level auditing of Active Directory is required.

Microsoft Documentation

Event ID - 5141