Event ID: 5141A directory service object was deleted.
A directory service object was deleted. Subject: Security ID: %3 Account Name: %4 Account Domain: %5 Logon ID: %6 Directory Service: Name: %7 Type: %8 Object: DN: %9 GUID: %10 Class: %11 Operation: Tree Delete: %12 Correlation ID: %1 Application Correlation ID: %2
This event generates every time an Active Directory object is deleted.
This event only generates if the deleted object has a particular entry in its SACL: the “Delete” action, auditing for specific objects.
Recommended if object-level auditing of Active Directory is required.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Directory Service Changes"
LEFT/RIGHT arrow keys for navigationBack to List