How to create a search and alert who modified (add/delete) DFS namespace (4370093)

• Login to the Change Auditor Client
• Click View | Administration | Auditing | Active Directory
• Click Add

• On "Active Directory Wizard" select "This object and all child objects"
• Add the DFS-Configuration object (found under the System container in AD)

• Type "msDFS-namespaceAnchor" under the "UnAudited Object class, and add the msDFS-NamespaceAnchor object class
• Click finish

• Select the Searches tab
• Create a new search
• Under the What tab add msDFS-NamespaceAnchor event class
• Click Save
• Click Run to run the search

 

 This is what the search result will show after adding a namespace:

When a namespace is deleted:

 

The Action section of the event will show if it is an Add or a Delete