Share via

Events 5136, 5137, 5141 are only logged on the Master Domain Controller

Scorpion 10 Reputation points
2023-02-26T03:23:10.2533333+00:00

I have enabled the auditing of Directory Service Objects (DS Objects), essentially to monitor the creation, deletion and modification of GPOs. I have two domain controllers, DC1 and DC2, the DC! is the Master DC. I'm using Windows Server 2022, on premise

When I run, on DC2, a creation, deletion, or modification of a GPO, I assumed those would be logged on the same DC2; but when I looked for the evnets in the Event Viewer, security panel, there was nothing. However, those events had been logged on DC1.

Shouldn't changes applied to GPOs in a particular DC allow events to be logged on that DC? I need help with this.

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
5,823 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,726 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,956 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 36,251 Reputation points Moderator
    2023-02-26T22:06:26.11+00:00

    Hi @Scorpion

    Check if the DC1 host the PDC role.

    By default GPMC console is connected to PDC when you try modify a GPO.

    Please don't forget to mark helpful answer as accepted

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.