These events are basically the coordinator making a "flat map" of AD. It uses the DC agents to scan AD OU by OU for computer objects and then writes that data to a table in the database.
If a computer object is removed from AD, on the next scan, the agent will notice that the computer object has disappeared from the OU that it was in and will send a Topology update to the coordinator. Similarly, when a new computer object gets detected in an OU, the agent will send a topology server added event. If you move a computer object between two different OUs, it will generate both events (one for removing the object from an OU and another for adding a computer object to the new OU).
You can look at the reference guide here for some more details:
https://support.quest.com/technical-documents/change-auditor/event-reference-guide/2#TOPIC-1563918
These are typically benign events and are really just part of CA harvesting a map of AD. You can probably correlate a lot of these events with Computer object moved and deleted events if you search for them although the timestamps won't line up exactly.
You're not going to see details on "who did the operation" because this is just an agent scanning for computer objects in AD and those details would have been captured under the AD event scope at another time when the move or delete would have been committed.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center