Event ID for OU change

Posted on 2011-10-12
Last Modified: 2012-05-12

One of the OU's in our domain was renamed today which caused issues. We would like to find out which user account made this change. I am unable to find out from search results which Event ID this would be categorised under.

There is auditing setup for all the OU's in the domain already so this should have been tracked, i just don't know which event ID to search for. Any help would be greatly appreciated.

Question by:MACNoel
    LVL 57

    Accepted Solution

    In windows 2008 it is event 4662 (see screenshot from my lab).  In 2003 it should be 566


    LVL 24

    Expert Comment

    If auditing is enabled then OU creation/deletion/move configured, you should be looking for event id 566 in windows 2003.

    The above event will be logged if Directory Service Access in auditing is enabled.

    Author Closing Comment

    Many thanks again Experts!

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    This is my first article in EE and english is not my mother tongue so any comments you have or any corrections you would like to make, please feel free to speak up :) For those of you working with AD, you already are very familiar with the classi…
    Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now