This query is one you are recommended to read the FULL context of the post to use. It is not simply a copy and paste query, like others in the forum. It is valuable under the right situation.
Hello,
I am not sure if I am in the right place here.
We need a query who changed an Active Directory object. E.g. who disabled or enabled a computer in AD.
There are queries for user objects but I haven't found any for computer objects.
Can someone help me out here?
Many Thanks
Hi Dennis Franz1
Do you have ACL auditing enabled on your DCs? AD does not record who changed an object, just the timestamp of the last change.
Thanks!
Hi Jeramy,
thanks for your reply. Yes ACL auditing is activ.
thanks a lot. I’m currently not in the office but I test it ASAP and give you a short feedback. Thanks again.