How to Identify who and when was the computer account moved from one OU to Other

Question

Recently we observed that 5 server moved form one OU to Other OU .Our Event logs stores only 2 days event . Is there any script or way to get the audit logs of Computer movement to other OU

Answer 1

Hello

Thank you for your question and reaching out.

You can only find out through auditing. The security event of the DC where the OU move originated would need to be checked.

If an object is moved from one organisational unit to another, event ID 5139 is registered.This event records the transfer of an AD object from one OU to another, identifying both the old and new locations of the object as well as the user that transferred it.

--If the reply is helpful, please Upvote and Accept as answer--