Who made a display name change in AD

One of my companies SVP found that they had their display name changed.
Is there a way I can find out who changed it?
The admin that corrected it did not view the object tab to see when it was previously changed but I would suspect it not be any greater than a day or two.
Where and how do I go about getting as much info on it as possible?
Thanks in advance
Who is Participating?
Chris DentPowerShell DeveloperCommented:

The only place you'll see that kind of information is the Security Log on your Domain Controllers. And you'll only see that if you already anticipated this moment and set up audit logging.

If you haven't set that up, or the Security logs rotate too quickly you're out of luck.

Sekar ChinnakannuStaff EngineerCommented:
Shabarinath RamadasanInfrastructure ArchitectCommented:
Ideally speaking, its difficult to track who made what change on which date from which system directly.
If you have thirdparty audit tools like Quest ChangeAuditor, its difficult to get this.

Good luck
fpstararaAuthor Commented:
never found the offending admin or process
Glen KnightCommented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.