Country/Region field value may not appear to be restored as expected when restoring value from the “Country/Region changed for user object” event in the Change Auditor Windows or web client (4381156)

After the value of the Country/Region field on the Address tab of a user in Active Directory Users and Computers (ADUC) is changed, it may not appear to be restored as expected in ADUC when using the Restore Value function on the “Country/Region changed for user object” event that is generated by default in the Change Auditor Windows or web clients when this change is made.

This occurs because only the “co” attribute change is captured and restored when restoring the value from this event.  There are three attributes that should be set on the object to restore and display the expected value in ADUC.

co: This attribute stores the country name (e.g. Canada, United States)

c: This attribute stores the country/region abbreviation (e.g. CA, US).

countryCode: This attribute stores the numeric value of the country code (e.g., 124 for Canada, 840 for the US).

Workaround

Add the ‘c’ and the ‘countryCode’ attributes for the user object class to the Active Directory monitored attributes list in Change Auditor.  Restore the values for all three changed attributes from the generated events when this change was made using ADUC to restore it to the previous value.