Chat now with support
Chat with Support

Change Auditor for Active Directory 7.1.1 - Event Reference Guide

DNS Service

 
 
Table 11. DNS Service events
Event
Description
Severity

Address Answer Limit Changed

Created when the Answer section address limit of the DNS service is changed.

Medium

AutoConfigFileZones Setting Changed

Created when the Automatic Configuration of Standard Primary Zones setting of the DNS service is changed.

Medium

BIND Secondaries Flag Changed

Created when the Bind secondaries setting of the DNS server is changed.

Medium

Database Directory Setting Changed

Created when the Database Directory setting of the DNS service is changed.

Medium

Default Aging State Setting Changed

Created when the Default Aging State of the DNS service is changed.

Medium

Disable Auto Reverse Zones Setting Changed

Created when the Disable Auto Reverse Zones setting of the DNS service is changed.

Medium

DisableNSRecordsAutoCreation

Created when the DisableNSRecordsAutoCreation registry entry is added, removed, or changed.

Medium

DNS Service Added

Created when a DNS service is added to a domain controller.

Medium

DNS Service Removed

Created when a DNS service is removed from a domain controller.

Medium

Enable Netmask Ordering Flag Changed

Created when the Netmask ordering setting of the DNS server is changed.

Medium

Enable Scavenging of Stale Resource Record Setting Changed

Created when the Automatic scavenging of stale resource records setting of the DNS server is changed.

Medium

Event Log Level Changed

Created when the Event Log Level setting of the DNS service is changed.

Medium

Fail On Load Flag Changed

Created when the Fail on load if bad zone data setting of the DNS server is changed.

Medium

Forward Delegations Setting Changed

Created when the Forward Delegations setting of the DNS service is changed.

Medium

Forwarder Timeout Changed

Created when the Number of seconds before forward queries time out setting of the DNS server is changed.

Medium

Forwarders List Changed

Created whenever an entry is added or removed from the Forwarders list.

Medium

IsSlave Setting Changed

Created when the IsSlave setting of the DNS service is changed.

Medium

Listen-on Interfaces Changed

Created whenever an entry is added or removed from the listen on interfaces list.

Medium

Log File Path Changed

Created when the Log File Path of the DNS service is changed.

Low

LogFileMaxSize Setting Changed

Created when the LogFileMaxSize setting of the DNS service is changed.

Low

Loose Wildcarding Setting Changed

Created when the Loose Wildcarding setting of the DNS service is changed.

Medium

Max Cache TTL Setting Changed

Created when the Max Cache TTL setting of the DNS service is changed.

Medium

Name Checking Option Changed

Created when the name checking option of the DNS server is changed.

Medium

No-refresh Interval Changed

Created when the No-refresh interval setting of the DNS server is changed.

Medium

Publish Addresses List Changed

Created when the Publish Addresses list of the DNS service is changed.

Medium

Publish Autonet Setting Changed

Created when the Publish Autonet setting of the DNS service is changed.

Medium

Recursion Flag Changed

Created when the Disable recursion setting of the DNS server is changed.

Medium

Recursion Retry Setting Changed

Created when the Recursion Retry setting of the DNS service is changed.

Medium

Recursion Timeout Setting Changed

Created when the Recursion Timeout setting of the DNS service is changed.

Medium

Refresh Interval Changed

Created when the Refresh interval setting of the DNS server is changed.

Medium

Round-robin Flag Changed

Created when the Enable round robin setting of the DNS server is changed.

Medium

RPC Protocol Setting Changed

Created when the RPC Protocol setting of the DNS service is changed.

Medium

Scavenging Period Changed

Created when the scavenging period setting of the DNS server is changed.

Medium

Secure Cache Against Pollution Flag Changed

Created when the Secure cache against pollution setting of the DNS server is changed.

Medium

Send Port Setting Changed

Created when the Send Port setting of the DNS service is changed.

Medium

Service Log Level Changed

Created when the diagnostic log level for a DNS service is changed.

Medium

Transfer Connect Timeout Setting Changed

Created when the Transfer Connect Timeout setting of the DNS service is changed.

Medium

Update Options Setting Changed

Created when the Update Options setting of the DNS service is changed.

Medium

WriteAuthorityNS Setting Changed

Created when the WriteAuthorityNS setting of the DNS service is changed.

Medium

Zone Added

Created when a new zone is added.

Medium

Zone Deleted

Created when a zone is deleted.

Medium

Zone Load Mode Changed

Created when the Load zone data on startup setting of the DNS server is changed.

Medium

DNS Zone

 
 
Table 12. DNS Zone events
Event
Description
Severity

Aging No-refresh Interval Changed

Created when the aging no-refresh interval of the zone is changed.

Medium

Aging Refresh Interval Changed

Created when the aging refresh interval of the zone is changed.

Medium

DNS AAAA Record Added

Created when the DNS host (AAAA) record is added to a zone. (Disabled by default)

NOTE: This event is captured for Active Directory® integrated DNS zones only.

Low

DNS AAAA Record Modified

Created when the DNS host (AAAA) record in a zone is modified. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS AAAA Record Removed

Created when the DNS host (AAAA) record is removed from a zone. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS A Record Added

Created when the DNS host (A) record is added to a zone. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS A Record Modified

Created when the DNS host (A) record in a zone is modified. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS A Record Removed

Created when the DNS host (A) record is removed from a zone. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS CNAME Record Added

Created when the DNS CNAME (Alias) record is added to a zone.

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS CNAME Record Removed

Created when the DNS CNAME (Alias) record is removed from a zone.

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS MX Record Added

Created when the DNS MX (Mail Exchange) record is added to a zone.

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS MX Record Removed

Created when the DNS MX (Mail Exchange) record is removed from a zone.

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS PTR Record Added

Created when the DNS PTR (Pointer) record is added to a zone. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS PTR Record Removed

Created when the DNS PTR (Pointer) record is removed from a zone. (Disabled by default)

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS SRV Record Added

Created when the DNS SRV (Service Locator) record is added to a zone.

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

DNS SRV Record Removed

Created when the DNS SRV (Service Locator) record is removed from a zone.

NOTE: This event is captured for Active Directory integrated DNS zones only.

Low

Expires After Period Changed

Created when the expires-after period has changed in the zone.

Disabled by default.

Medium

Name Server Added

Created when a name server is added to the zone.

Disabled by default.

Medium

Name Server Removed

Created when a name server is removed from the zone.

Disabled by default.

Medium

Primary Server Changed

Created when the primary server in the SOA has changed in the zone.

Disabled by default.

Medium

Retry Interval Changed

Created when the retry interval has changed in the zone.

Disabled by default.

Medium

WINS Forwarding Flag Disabled

Created when WINS forwarding flag is disabled in the zone.

Disabled by default.

Low

WINS Forwarding Flag Enabled

Created when WINS forwarding flag is enabled in the zone.

Disabled by default.

Low

WINS Forwarding Host List Changed

Created when the WINS forwarding host list has changed in the zone.

Disabled by default.

Low

Zone Allow Dynamic Updates Flag Changed

Created when the allow dynamic updates flag is changed in the zone.

Medium

Zone Default TTL Changed

Created when the default TTL has changed in the zone.

Disabled by default.

Medium

Zone Delegation Added

Created when a zone is delegated.

Disabled by default.

Medium

Zone Delegation Removed

Created when a zone delegation is removed.

Disabled by default.

Medium

Zone Refresh Interval Changed

Created when the refresh interval has changed in the zone.

Disabled by default.

Medium

Zone Replication Scope Changed

Created when the zone replication scope is changed.

Medium

Zone Scavenging Flag Changed

Created when scavenging is enabled or disabled in the zone.

Medium

Zone Storage Changed

Created when the zone storage is changed.

Medium

Zone Transfer Flag Changed

Created when the zone transfer flag of the zone is changed.

Medium

Zone Transfer Host List Changed

Created when the zone transfer host list of the zone is changed.

Medium

Zone Type Changed

Created when the zone type is changed.

Medium

Domain Configuration

 
 
Table 13. Domain Configuration events
Event
Description
Severity

Allowed DNS Suffix List Changed for Domain

Created when a new value is added to or removed from the list of allowed DNS suffixes for a domain.

Medium

DACL Changed on AdminSDHolder Object

Created when the DACL is changed for an object located at CN=AdminSDHolder,CN=System, DC=<Domain Name>.

NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.

High

DACL Changed on Domain Object

Created when the DACL is changed on a domain object.

NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.

High

Default Quota for Partition Changed

Created when the default object quota for the Configuration NC, a domain NC, or an application partition is changed.

Medium

Domain Controller Added to Domain

Created when a new domain controller is promoted into the domain.

Medium

Domain Controller Removed from Domain

Created when a domain controller is demoted from the domain.

Medium

Domain Controller Renamed

Created when a domain controller is renamed.

Medium

Domain Functional Level Changed

Created when the domain functional level is changed.

Medium

Domain Group Policy Order Changed

Created when the list of group policies linked to a domain is re-ordered.

Medium

Guest Account Disabled

Created when the Guest account is disabled in a domain.

Medium

Guest Account Enabled

Created when the Guest account is enabled in a domain.

Medium

Infrastructure FSMO Role Owner Moved

Created when the infrastructure FSMO role owner is changed from one DC to another.

High

Object Quota Added

Created when a new object quota is added to an NC.

Medium

Object Quota Removed

Created when an object quota is removed from an NC.

Medium

PDC FSMO Role Owner Moved

Created when the PDC FSMO role owner is changed from one DC to another.

High

Quota Security Principal Changed

Created when the security principal for an existing quota is changed.

Medium

Quota Value Changed

Created when the quota value for an existing quota is changed.

Medium

Read-Only Domain Controller Added to Domain

Created when a Read-Only Domain Controller is added to a domain.

Medium

Read-Only Domain Controller Removed from Domain

Created when a Read-Only Domain Controller is demoted.

Medium

Read-Only Domain Controller Renamed

Created when a Read-Only Domain Controller is renamed.

Medium

RID FSMO Role Owner Moved

Created when the RID FSMO role owner is changed from one DC to another.

High

Tombstone Quota Factor for Partition Changed

Created when the quota factor for tombstone objects is changed for the Configuration NC, a domain NC, or an application partition.

Medium

Trust Added

Created when a Trust is created between 2 domains.

Medium

Trust Removed

Created when a Trust is removed.

High

Dynamic Access Control

* 
NOTE: Dynamic Access Control is available in Windows® Server 2012; therefore, the events in this facility do not apply to earlier versions of Windows Server.
 
Table 14. Dynamic Access Control events
Event
Description
Severity

Central Access Policy Created

Created when a Central Access Policy is created.

Medium

Central Access Policy Description Changed

Created when the description of a Central Access policy is changed.

Medium

Central Access Policy Deleted

Created when a Central Access Policy is deleted.

Medium

Central Access Policy Permission Changed

Created when the permission of a Central Access Policy is changed.

High

Central Access Policy Rule Added

Created when a rule is added to a Central Access Policy.

Medium

Central Access Policy Rule Changed

Created when a rule for a Central Access Policy is changed.

Medium

Central Access Policy Rule Removed

Created when a rule is removed from a Central Access Policy.

Medium

Central Access Rule Created

Created when a central access rule is created.

Medium

Central Access Rule Description Changed

Created when the description of a central access rule is changed.

Medium

Central Access Rule Deleted

Created when a central access rule is deleted.

Medium

Central Access Rule Effective Permission Changed

Created when the effective permission of a central access rule is changed.

High

Central Access Rule Permission Changed

Created when the permission of a central access rule is changed.

High

Central Access Rule Proposed Permission Changed

Created when the proposed permission of a central access rule is changed.

High

Central Access Rule Target Resource Changed

Created when the target resource of a central access rule is changed.

Medium

Claim Type AD Attribute Changed

Created when an AD attribute for a claim type is changed.

Medium

Claim Type Class Added

Created when a claim type class is added.

Medium

Claim Type Class Changed

Created when a claim type class is changed.

Medium

Claim Type Class Removed

Created when a claim type class is removed.

Medium

Claim Type Created

Created when a claim type is created.

Medium

Claim Type Deleted

Created when a claim type is deleted.

Medium

Claim Type Description Changed

Created when the description of a claim type is changed.

Medium

Claim Type Disabled

Created when a claim type is disabled.

Medium

Claim Type Display Name Changed

Created when the display name of a claim type is changed.

Medium

Claim Type Enabled

Created when a claim type is enabled.

Medium

Claim Type Permission Changed

Created when the permission of a claim type is changed.

High

Claim Type Suggested Values Changed

Created when the suggested values of a claim type are changed.

Medium

Reference Resource Property Created

Created when a reference resource property is created.

Medium

Reference Resource Property Deleted

Created when a reference resource property is deleted.

Medium

Reference Resource Property Description Changed

Created when the description of a reference resource property is changed.

Medium

Reference Resource Property Disabled

Created when a reference resource property is disabled.

Medium

Reference Resource Property Display Name Changed

Created when the display name of a reference resource property is changed.

Medium

Reference Resource Property Enabled

Created when a reference resource policy is enabled.

Medium

Reference Resource Property Permission Changed

Created when the permission of a reference resource policy is changed.

High

Resource Property Created

Created when a resource property is created.

Medium

Resource Property Deleted

Created when a resource property is deleted.

Medium

Resource Property Description Changed

Created when the description for a resource property is changed.

Medium

Resource Property Disabled

Created when a resource property is disabled.

Medium

Resource Property Display Name Changed

Created when the display name for a resource property is changed.

Medium

Resource Property Enabled

Created when a resource property is enabled.

Medium

Resource Property Permission Changed

Created when the permission for a resource property is changed.

High

Resource Property Suggested Values Changed

Created when the suggested values for a resource property are changed.

Medium

Resource Property List Created

Created when a resource property list is created.

Medium

Resource Property List Deleted

Created when a resource property list is deleted.

Medium

Resource Property List Description Changed

Created when the description of a resource property list is changed.

Medium

Resource Property List Member Added

Created when a member is added to a resource property list.

Medium

Resource Property List Member Changed

Created when a member of a resource property list is changed.

Medium

Resource Property List Member Removed

Created when a member is removed from a resource property list.

Medium

Resource Property List Permission Changed

Created when the permission of a resource property list is changed.

High

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating