• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2369
  • Last Modified:

Event ID for OU change

Hi,

One of the OU's in our domain was renamed today which caused issues. We would like to find out which user account made this change. I am unable to find out from search results which Event ID this would be categorised under.

There is auditing setup for all the OU's in the domain already so this should have been tracked, i just don't know which event ID to search for. Any help would be greatly appreciated.

Thanks!
0
MACNoel
Asked:
MACNoel
1 Solution
 
Mike KlineCommented:
In windows 2008 it is event 4662 (see screenshot from my lab).  In 2003 it should be 566   http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4662


Thanks

Mike
OU-name-change.jpg
0
 
SandeshdubeyCommented:
If auditing is enabled then OU creation/deletion/move configured, you should be looking for event id 566 in windows 2003.

The above event will be logged if Directory Service Access in auditing is enabled.
http://support.microsoft.com/kb/232714
http://technet.microsoft.com/en-us/library/cc728087(WS.10).aspx
0
 
MACNoelAuthor Commented:
Many thanks again Experts!
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Tackle projects and never again get stuck behind a technical roadblock.
Join Now