"User employeeID changed" is not captured by default, the event class must be moved from the Unmonitored to the Monitored Attributes list using the following steps.
- Select “View” | “Administration” (Ctrl+F12) from the main menu of the Change Auditor Client
- Select “Auditing” in the bottom left pane of the “Administration” Task tab
- In the left hand tree select Forest or Directories (depending on the version) | Active Directory | Attributes.
- Select “user” Schema Class in the upper right pane of the “Administrative Task” tab
- Enter “employeeid” in the filter section of the Unsupported attribute list box
- Select the attribute and click the “Add” button to move the selection to the Monitored Attributes list on the right.
Refresh all AD agents so the effect is immediate.
You can now create a Search for the event User employeeID Changed.