How to Identify who and when was the computer account moved from one OU to Other

Anusha Thota 0 Reputation points
2023-05-23T14:41:23.05+00:00

Recently we observed that 5 server moved form one OU to Other OU .Our Event logs stores only 2 days event . Is there any script or way to get the audit logs of Computer movement to other OU

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,204 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,101 Reputation points
    2023-05-24T11:10:08.7333333+00:00

    Hello

    Thank you for your question and reaching out.

    You can only find out through auditing. The security event of the DC where the OU move originated would need to be checked.

    If an object is moved from one organisational unit to another, event ID 5139 is registered.This event records the transfer of an AD object from one OU to another, identifying both the old and new locations of the object as well as the user that transferred it.

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments