Does ChangeAuditor report as to which tool has made changes through RSAT Tools / ADSIEDIT / LDAP Browser / PowerShell (4285134)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Does ChangeAuditor report as to which tool has made changes through RSAT Tools / ADSIEDIT / LDAP Browser / PowerShell
Description

If an admin performs a modification in AD through RSAT Tools / ADSIEDIT / LDAP Browser / PowerShell, will Change Auditor report which tool made the change?
Resolution

Change Auditor hooks directly to LSASS to log the information coming in from AD on the fly, thus it does not provide any other information than what happened, when, and by whom.

A simple test of creating a user using PowerShell will show the recorded event of a user being created and who created the user, but is agnostic of which interface or tool the change was made in.

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title