How to Identify who and when was the computer account moved from one OU to Other

Anusha Thota 0 Reputation points
2023-05-23T14:41:23.05+00:00

Recently we observed that 5 server moved form one OU to Other OU .Our Event logs stores only 2 days event . Is there any script or way to get the audit logs of Computer movement to other OU

Windows for business | Windows Client for IT Pros | Directory services | Active Directory
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,766 Reputation points
    2023-05-24T11:10:08.7333333+00:00

    Hello

    Thank you for your question and reaching out.

    You can only find out through auditing. The security event of the DC where the OU move originated would need to be checked.

    If an object is moved from one organisational unit to another, event ID 5139 is registered.This event records the transfer of an AD object from one OU to another, identifying both the old and new locations of the object as well as the user that transferred it.

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.