Event ID 5139: A directory service object was moved.
|Description||A directory service object was undeleted.|
|Subcategory||Directory service changes|
This event logs the following information:
Reasons to monitor this event:
Moving an object in Active Directory from one OU to another has an effect on more than one variable such as group membership changes, deviant group policy settings, etc. It is a security violation that must be monitored.
ADAudit Plus offers extensive monitoring of directory service object creation and modification such as OU, GPO, container, contact, DNS node etc.
Event 5139 applies to the following operating systems:
- Windows Server 2008 R2 and 7
- Windows Server 2012 R2 and 8.1
- Windows Server 2016 and 10