Changes to the domain root object are not shown when querying all actions of a user. (4319621)

If a user removes an ACE from the domain root object and then search Change Auditor for all actions of the user who committed the change, no data is returned.

The Domain Root Schema Class object is not included by default.

To capture changes made to the DACL of the Domain Root, the “DomainDNS” Schema Class must be added to Active Directory Audit Configuration. This allows the Domain Root (DomainDNS) attributes to appear in the monitored Attributes list.

The nTSecurityDescriptor attribute must be moved to the monitored attributes list, since permissions (DACL) are stored in this attribute.

Complete the following steps to capture changes to the DACL at the domain root.

1. Select “Auditing” |”Active Directory” in the Administration Tasks tab of the Change Auditor client.
2. Click the “Add” or “Plus” (+) button in the button bar menu towards the top of the right pane
3. Select the “This Object” radio button towards the top of the Active Directory Auditing Wizard, highlight the domain root and click Finish.
4. Select “Attributes” towards the top of the left pane and highlight the DomainDNS Schema class.
5. Search for and select the nTSecurityDescriptor attribute in the Unmonitored Attributes list on the left.
6. Click add to move the selected attribute to the Monitored Attributes list on the right.

Refresh the configuration for all the agents on Domain Controllers.