Event ID 5169
A directory service object was modified.A directory service object was modified.
Subject:
Security ID: %3
Account Name: %4
Account Domain: %5
Logon ID: %6
Directory Service:
Name: %7
Type: %8
Object:
DN: %9
GUID: %10
Class: %11
Attribute:
LDAP Display Name: %12
Syntax (OID): %13
Value: %14
Expiration Time: %15
Operation:
Type: %16
Correlation ID: %1
Application Correlation ID: %2This event documents modifications to AD objects, identifying the object, user, attribute modified, the new value of the attribute if applicable and the operation performed.
Auditing:
Conditional
Use it for sensitive groups (Domain Admins), Service Accounts, and Root OUs.
Volume:
Low
The expected volume for this event is low in typical environments utilizing targeted SACLs.
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"Directory Service Access"
Operating Systems:
Windows 2016 Windows 2019 Windows 2022 Windows 2025Tags:
Domain Controller Audit Success Audit FailureLEFT/RIGHT arrow keys for navigation
Back to List