• Become a portal pro
• Download
• Print
• My Downloads ()

• Support
• Technical Documentation
• Change Auditor for Active Directory 7.3
• Change Auditor for Active Directory 7.3 - Event Reference Guide

Change Auditor for Active Directory 7.3 - Event Reference Guide

Table of Contents  

Introduction Change Auditor for Active Directory Events

Active Directory Database Active Directory Federation Services - Authentication Methods Active Directory Federation Services - Claims Provider Trusts Active Directory Federation Services - Endpoints Active Directory Federation Services - Relying Party Trusts Active Directory Federation Services - Server Farm Configuration Monitoring Connection Object Custom AD Object Monitoring Custom Computer Monitoring Custom Group Monitoring Custom User Monitoring DNS Service DNS Zone Domain Configuration Dynamic Access Control Forest Configuration FRS Service Group Policy Item Group Policy Object IP Security NETLOGON Service NTDS Service Organizational Unit (OU) Replication Transport Schema Configuration Site Configuration Site Link Bridge Configuration Site Link Configuration Subnets SYSVOL

Log Events

InTrust for AD event log InTrust for ADAM event Log

• Viewing Topics 17 - 20 of 36

×

Domain Configuration

 

 

Table 15. Domain Configuration events

Event	Description	Severity
Allowed DNS Suffix List Changed for Domain	Created when a new value is added to or removed from the list of allowed DNS suffixes for a domain.	Medium
DACL Changed on AdminSDHolder Object	Created when the DACL is changed for an object located at CN=AdminSDHolder,CN=System, DC=<Domain Name>. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.	High
DACL Changed on Domain Object	Created when the DACL is changed on a domain object. NOTE: Change Auditor access control list (ACL) events (discretionary access control list (DACL) and system access control list (SACL) changes), will not report inherited access control entry (ACE) changes. This event does NOT report inherited ACL changes.	High
Default Quota for Partition Changed	Created when the default object quota for the Configuration NC, a domain NC, or an application partition is changed.	Medium
Domain Controller Added to Domain	Created when a new domain controller is promoted into the domain.	Medium
Domain Controller Removed from Domain	Created when a domain controller is demoted from the domain.	Medium
Domain Controller Renamed	Created when a domain controller is renamed.	Medium
Domain Functional Level Changed	Created when the domain functional level is changed.	Medium
Domain Group Policy Order Changed	Created when the list of group policies linked to a domain is re-ordered.	Medium
Guest Account Disabled	Created when the Guest account is disabled in a domain.	Medium
Guest Account Enabled	Created when the Guest account is enabled in a domain.	Medium
Infrastructure FSMO Role Owner Moved	Created when the infrastructure FSMO role owner is changed from one DC to another.	High
Inheritance Setting Changed on AdminSDHolder Object	Created when the inheritance setting of an AdminSDHolder object is changed.	High
Object Quota Added	Created when a new object quota is added to an NC.	Medium
Object Quota Removed	Created when an object quota is removed from an NC.	Medium
PDC FSMO Role Owner Moved	Created when the PDC FSMO role owner is changed from one DC to another.	High
Quota Security Principal Changed	Created when the security principal for an existing quota is changed.	Medium
Quota Value Changed	Created when the quota value for an existing quota is changed.	Medium
Read-Only Domain Controller Added to Domain	Created when a Read-Only Domain Controller is added to a domain.	Medium
Read-Only Domain Controller Removed from Domain	Created when a Read-Only Domain Controller is demoted.	Medium
Read-Only Domain Controller Renamed	Created when a Read-Only Domain Controller is renamed.	Medium
RID FSMO Role Owner Moved	Created when the RID FSMO role owner is changed from one DC to another.	High
Tombstone Quota Factor for Partition Changed	Created when the quota factor for tombstone objects is changed for the Configuration NC, a domain NC, or an application partition.	Medium
Trust Added	Created when a Trust is created between 2 domains.	Medium
Trust Removed	Created when a Trust is removed.	High

Dynamic Access Control

NOTE: Dynamic Access Control is available in Windows® Server 2012; therefore, the events in this facility do not apply to earlier versions of Windows Server.

 

Table 16. Dynamic Access Control events

Event	Description	Severity
Central Access Policy Created	Created when a Central Access Policy is created.	Medium
Central Access Policy Description Changed	Created when the description of a Central Access policy is changed.	Medium
Central Access Policy Deleted	Created when a Central Access Policy is deleted.	Medium
Central Access Policy Permission Changed	Created when the permission of a Central Access Policy is changed.	High
Central Access Policy Rule Added	Created when a rule is added to a Central Access Policy.	Medium
Central Access Policy Rule Changed	Created when a rule for a Central Access Policy is changed.	Medium
Central Access Policy Rule Removed	Created when a rule is removed from a Central Access Policy.	Medium
Central Access Rule Created	Created when a central access rule is created.	Medium
Central Access Rule Description Changed	Created when the description of a central access rule is changed.	Medium
Central Access Rule Deleted	Created when a central access rule is deleted.	Medium
Central Access Rule Effective Permission Changed	Created when the effective permission of a central access rule is changed.	High
Central Access Rule Permission Changed	Created when the permission of a central access rule is changed.	High
Central Access Rule Proposed Permission Changed	Created when the proposed permission of a central access rule is changed.	High
Central Access Rule Target Resource Changed	Created when the target resource of a central access rule is changed.	Medium
Claim Type AD Attribute Changed	Created when an AD attribute for a claim type is changed.	Medium
Claim Type Class Added	Created when a claim type class is added.	Medium
Claim Type Class Changed	Created when a claim type class is changed.	Medium
Claim Type Class Removed	Created when a claim type class is removed.	Medium
Claim Type Created	Created when a claim type is created.	Medium
Claim Type Deleted	Created when a claim type is deleted.	Medium
Claim Type Description Changed	Created when the description of a claim type is changed.	Medium
Claim Type Disabled	Created when a claim type is disabled.	Medium
Claim Type Display Name Changed	Created when the display name of a claim type is changed.	Medium
Claim Type Enabled	Created when a claim type is enabled.	Medium
Claim Type Permission Changed	Created when the permission of a claim type is changed.	High
Claim Type Suggested Values Changed	Created when the suggested values of a claim type are changed.	Medium
Reference Resource Property Created	Created when a reference resource property is created.	Medium
Reference Resource Property Deleted	Created when a reference resource property is deleted.	Medium
Reference Resource Property Description Changed	Created when the description of a reference resource property is changed.	Medium
Reference Resource Property Disabled	Created when a reference resource property is disabled.	Medium
Reference Resource Property Display Name Changed	Created when the display name of a reference resource property is changed.	Medium
Reference Resource Property Enabled	Created when a reference resource policy is enabled.	Medium
Reference Resource Property Permission Changed	Created when the permission of a reference resource policy is changed.	High
Resource Property Created	Created when a resource property is created.	Medium
Resource Property Deleted	Created when a resource property is deleted.	Medium
Resource Property Description Changed	Created when the description for a resource property is changed.	Medium
Resource Property Disabled	Created when a resource property is disabled.	Medium
Resource Property Display Name Changed	Created when the display name for a resource property is changed.	Medium
Resource Property Enabled	Created when a resource property is enabled.	Medium
Resource Property Permission Changed	Created when the permission for a resource property is changed.	High
Resource Property Suggested Values Changed	Created when the suggested values for a resource property are changed.	Medium
Resource Property List Created	Created when a resource property list is created.	Medium
Resource Property List Deleted	Created when a resource property list is deleted.	Medium
Resource Property List Description Changed	Created when the description of a resource property list is changed.	Medium
Resource Property List Member Added	Created when a member is added to a resource property list.	Medium
Resource Property List Member Changed	Created when a member of a resource property list is changed.	Medium
Resource Property List Member Removed	Created when a member is removed from a resource property list.	Medium
Resource Property List Permission Changed	Created when the permission of a resource property list is changed.	High

Forest Configuration

 

 

Table 17. Forest Configuration events

Event	Description	Severity
Alternate UPN Suffix Added to Enterprise	Created when an entry is added to the list of alternate UPN suffixes available for user names.	Medium
Alternate UPN Suffix Removed from Enterprise	Created when an entry is removed from the list of alternate UPN suffixes available for user names.	Medium
Cross-forest Trust Added	Created when a trust is created between 2 forests.	Medium
Cross-forest Trust Removed	Created when a trust is removed between 2 forests.	High
Domain Added	Created when a domain is added to the partitions container.	High
Domain FSMO Role Owner Moved	Created when the domain naming FSMO role owner is changed from one DC to another.	High
Domain Removed	Created when a domain is removed from the partitions container.	High
Extended Access Right Added	Created when a new extended access right object is added to the system.	Medium
Extended Access Right Removed	Created when an extended access right object is removed from the system.	Medium
Forest Functional Level Changed	Created when the forest functional level is changed.	High
GC Added	Created when a domain controller is promoted from a non-GC to a GC.	Medium
GC Removed	Created when a domain controller is demoted from a GC to a non-GC.	High
Member Added to Critical Enterprise Group	Created when a new member is added to one of the critical enterprise groups. Critical enterprise groups include: • Server Operators • Print Operators • Network Configuration Operators • Incoming Forest Trust Builders • Backup Operators • Administrators • Account Operators • Cert Publishers • DHCP Administrators • Domain Admins • Domain Controllers • Enterprise Admins • Group Policy Creator Owners • RAS and IAS Servers • Schema Admins	High
Member Removed from Critical Enterprise Group	Created when a new member is removed from one of the critical enterprise groups. Critical enterprise groups include: • Server Operators • Print Operators • Network Configuration Operators • Incoming Forest Trust Builders • Backup Operators • Administrators • Account Operators • Cert Publishers • DHCP Administrators • Domain Admins • Domain Controllers • Enterprise Admins • Group Policy Creator Owners • RAS and IAS Servers • Schema Admins	High
Nested Member Added to Critical Enterprise Group	Created when a member is added to a nested group in a critical enterprise group.	High
Nested Member Removed from Critical Enterprise Group	Created when a member is removed from a nested group in a critical enterprise group.	Medium
Query Policy Added	Created when a new domain controller query policy is added.	Low
Query Policy Removed	Created when a domain controller query policy object is removed.	Low
Schema FSMO Role Owner Moved	Created when the schema FSMO role owner is changed from one DC to another.	High
Site Added	Created when a new site is added to the forest.	Medium
Site Link Added	Created when a site link is added to either the IP or SMTP containers.	Medium
Site Link Bridge Added	Created when a site link bridge is added to either the IP or SMTP containers.	Medium
Site Link Bridge Removed	Created when a site link bridge is removed from either the IP or SMTP containers.	High
Site Link Removed	Created when a site link is removed from either the IP or SMTP containers.	High
Site Removed	Created when a site is removed from the forest.	High
Site Renamed	Created when an existing site is renamed.	Medium
Subnet Added	Created when a new subnet is added.	Medium
Subnet Removed	Created when a subnet is removed.	High

FRS Service

 

Table 18. FRS Service events

Event	Description	Severity
FRS Access Check Changed	Created when an FRS access check is changed.	Low
FRS Directory Exclusion Filter List Changed on Domain Controller	Created when the FRS directory exclusion filter list on a domain controller is changed.	Low
FRS Directory Exclusion Filter List Changed on Replica Set	Created when the FRS directory exclusion filter list on a Replica Set is changed.	Low
FRS File Exclusion Filter List Changed for Replica Set	Created when the FRS file exclusion filter list on a Replica Set is changed.	Low
FRS File Exclusion Filter List Changed on Domain Controller	Created when the FRS file exclusion filter list on a Domain controller is changed.	Low
FRS Mutual Authentication Setting Changed	Created when the FRS mutual authentication is changed.	Low
FRS RPC TCP/IP Port Assignment Changed	Created when the FRS TCP/IP port assignment is changed.	Low
FRS Staging Space Limit Changed	Created when the FRS Staging space limit is changed.	Low
FRS Working Directory Changed	Created when the FRS working directory is changed.	Low

•  Previous
• Viewing Topics 17 - 20 of 36
• Next 

Search this document Search all documents

×

 Welcome to Quest Support

You can find online support help for Quest *product* on an affiliate support site. Click continue to be directed to the correct support content and assistance for *product*.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center