• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2631
  • Last Modified:

Event ID for OU change

Hi,

One of the OU's in our domain was renamed today which caused issues. We would like to find out which user account made this change. I am unable to find out from search results which Event ID this would be categorised under.

There is auditing setup for all the OU's in the domain already so this should have been tracked, i just don't know which event ID to search for. Any help would be greatly appreciated.

Thanks!
0
MACNoel
Asked:
MACNoel
1 Solution
 
Mike KlineCommented:
In windows 2008 it is event 4662 (see screenshot from my lab).  In 2003 it should be 566   http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4662


Thanks

Mike
OU-name-change.jpg
0
 
SandeshdubeySenior Server EngineerCommented:
If auditing is enabled then OU creation/deletion/move configured, you should be looking for event id 566 in windows 2003.

The above event will be logged if Directory Service Access in auditing is enabled.
http://support.microsoft.com/kb/232714
http://technet.microsoft.com/en-us/library/cc728087(WS.10).aspx
0
 
MACNoelAuthor Commented:
Many thanks again Experts!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now