Re: Logging/tracking AD changes

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

you need to turn on auditing for Directory Service Access (success). then check the security event log

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------

"Clubsprint" <spamspamspamspam@xxxxxxxxxx> wrote in message news:ger2er$f0$1@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Soemone in our organization moved an OU in our tree. I hve a suspicion who did it and am concerned that it was malicious.
I can't find an entry anywhere in the eventlogs for the move. Is there anywher else that the change would be logged that I can refer to?
Mark



.

Relevant Pages

  • Re: Infrastructure FSMO role owner attibute not correct in root do
    ... I connected to the infrastructure FSMO role holder for the root ... I don't know i that was the real "fix" or just a coincidence or not though. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ...
    (microsoft.public.windows.server.active_directory)
  • Re: Site link configuration question..
    ... "i have multiple BO link to the nearest HUB in a single Site Link?" ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ... tCategory=siteLink" siteObjectBL ...
    (microsoft.public.windows.server.active_directory)
  • Re: Site link configuration question..
    ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... * This posting is provided "AS IS" with no warranties and confers no rights! ... Always test ANY suggestion in a test environment before implementing! ...
    (microsoft.public.windows.server.active_directory)
  • Re: Adprep /rodcprep error message
    ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ... Because of stale DNS records I strongly ... fSMORoleOwner: CN=NTDS ...
    (microsoft.public.windows.server.active_directory)
  • Re: fSMORoleOwner in CN=Infrastructure DomainDNSZones & ForestDNSZ
    ... NETDOM QUERY FSMO ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... Always test ANY suggestion in a test environment before implementing! ...
    (microsoft.public.windows.server.active_directory)