Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Change Auditor for Active Directory 7.1.1 - Event Reference Guide

Table of Contents

Introduction Change Auditor for Active Directory Events

Active Directory Database Active Directory Federation Services - Authentication Methods Active Directory Federation Services - Sign-in Active Directory Federation Services - Relying Party Trusts Configuration Monitoring Connection Object Custom AD Object Monitoring Custom Computer Monitoring Custom Group Monitoring Custom User Monitoring DNS Service DNS Zone Domain Configuration Dynamic Access Control Forest Configuration FRS Service Group Policy Item Group Policy Object IP Security NETLOGON Service NTDS Service Organizational Unit (OU) Replication Transport Schema Configuration Site Configuration Site Link Bridge Configuration Site Link Configuration Subnets SYSVOL

InTrust for AD event log InTrust for ADAM event Log

IP Security

Table 19. IP Security events
Event	Description	Severity
IP Security Filter Action Created	Created when a new IP Security Filter Action is created.	Medium
IP Security Filter Action Deleted	Created when an IP Security Filter Action is removed.	Medium
IP Security Filter Action Option Changed	Created when an IP Security Filter Action Security option is changed.	Medium
IP Security Filter Action Security Method Changed	Created when an IP Security Filter Action Security Method is changed.	Medium
IP Security Filter List Created	Created when a new IP Security Filter List is created.	Medium
IP Security Filter List Deleted	Created when an IP Security Filter List is removed.	Medium
IP Security Filter List Option Changed	Created when an IP Security Filter List option is changed.	Medium
IP Security Policy Created	Created when a new IP Security setting is created in a domain.	Medium
IP Security Policy Deleted	Created when an IP Security setting is deleted from a domain.	Medium
IP Security Policy Key Exchange Settings Changed	Created when one or more key exchange settings are changed in an IP Security Policy.	Medium
IP Security Policy Option Changed	Created when one or more options are changed in an IP Security Policy.	Medium
IP Security Rule Created	Created when an IP Security Rule is created.	Medium
IP Security Rule Deleted	Created when an IP Security Rule is deleted.	Medium
IP Security Rule Filter Action Changed	Created when the Filter Action of an IP Security Rule is changed.	Medium
IP Security Rule Filter List Changed	Created when the Filter List of an IP Security Rule is changed.	Medium
IP Security Rule Option Changed	Created when one or more options are changed in an IP Security Rule.	Medium
Rule Added to IP Security Policy Rule List	Created when a rule is added (checked) to the IP Security Rule list of an IP Security Policy.	Medium
Rule Removed from IP Security Policy Rule List	Created when a rule is removed (cleared) from the IP Security Rule list of an IP Security Policy.	Medium

NETLOGON Service

Table 20. NETLOGON Service events
Event	Description	Severity
NETLOGON AutoSiteCoverage Flag Changed	Created when the AutoSiteCoverage flag is changed.	Medium
NETLOGON CloseSiteTimeout Parameter Changed	Created when the CloseSiteTimeout value is changed.	Medium
NETLOGON Diagnostic Logging Parameter Changed	Created when the diagnostic log level for the NETLOGON service is changed.	Medium
NETLOGON DnsAvoidRegisterRecords Parameter Changed	Created when the contents of the DnsAvoidRegisterRecords registry entry is changed.	Medium
NETLOGON GcSiteCoverage Parameter Changed	Created when the GcSiteCoverage registry entry is changed.	Medium
NETLOGON LdapSrvPriority Parameter Changed	Created when the LdapSrvPriority registry entry is added, removed, or changed.	Medium
NETLOGON LdapSrvWeight Parameter Changed	Created when the LdapSrvWeight value is changed.	Medium
NETLOGON SiteCoverage Parameter Changed	Created when the contents of the SiteCoverage registry entry is changed.	Medium
NETLOGON SiteName Parameter Changed	Created when the SiteName registry entry is added, removed, or changed.	Medium

NTDS Service

Table 21. NTDS Service events
Event	Description	Severity
NTDS Default TTL Changed	Created whenever the default TTL is changed.	Low
NTDS Garbage Collection Period Changed	Created whenever the garbage collection period is changed.	Low
NTDS Minimum TTL Changed	Created whenever the minimum TTL is changed.	Low
NTDS TCP/IP Port Assignment Changed	Created when the NTDS RPC TCP/IP port assignment is changed.	Low
NTDS Tombstone Lifetime Setting Changed	Created whenever the tombstone lifetime is altered.	Low

Organizational Unit (OU)

Table 22. Organizational Unit (OU) events
Event	Description	Severity
Alternate UPN Suffix Added to OU	Created when an entry is added to the list of alternate user principal name (UPN) suffixes available for user names.	Medium
Alternate UPN Suffix Removed from OU	Created when an entry is removed from the list of alternate user principal name (UPN) suffixes available for user names.	Medium
DACL Changed on OU Object	Created when the DACL is changed on an OU object. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.	High
Domain Controller Added to OU	Created when a domain controller is added to an OU.	High
Domain Controller Removed from OU	Created when a domain controller is removed from an OU.	High
OU Group Policy Order Changed	Created when the list of group policies linked to an organizational unit is re-ordered.	Medium
Subordinate OU Added	Created when an OU is added to another OU.	Medium
Subordinate OU Removed	Created when an OU is removed from another OU.	Medium
Subordinate OU Renamed	Created when a subordinate OU is renamed.	Medium

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center