| ID | Event Description |
|---|---|
| 4657 | A registry value was modified Audit Success |
| 4662 | An operation was performed on an object Domain Controller, Audit Success, Audit Failure |
| 5136 | A directory service object was modified Domain Controller, Audit Success |
| 5169 | A directory service object was modified. Domain Controller, Audit Success, Audit Failure |