Active Directory

Question

I have used active directory server 2019 but how can i find out user attribute change like modified date or attribute type change

Answer 1

Hello jabad007,

Thank you for posting in Microsoft Community forum.

Which user attribute or all the user attributes are you talking about?

Which one AD user or some AD users or all AD users are you talking about?

If you have any questions or concerns, please don't hesitate to let us know.

Best Regards,
Daisy Zhou

Answer 2

Hi

Daisy Zhou123

Thanks for your reply

we are using active directory server 2019 on-premise we have more than 1000 users we have 4 administrators for user managed like user create delete and update , last week minimum 600 user modified showing when i do this command like (Get-ADUser -Filter * -Properties * | select Name, Created,whenchanged | out-Gridview) but i want to need specific change option of my AD user and how change this

your query is

Which user attribute or all the user attributes are you talking about? single user

Which one AD user or some AD users or all AD users are you talking about? single user

Answer 3

Hello jabad007,

Thank you for your reply.

You enable audit permission in domain.

Right click domain name, Security tab, Advanced button, Auditing tab, Add button.
Principle: Everyone

Type: Success or all
Applies to: user objects.
Permissions: You can check depending on your need.

After that, if any of user creation, deletion and update occurs, you can check the event ID on DC security logs.

You can see Events List based on the link below.

Audit User Account Management - Windows Security | Microsoft Learn

Best Regards,
Daisy Zhou

Answer 4

We enable this only

Can i enable another one

Answer 5

Hello jabad007,

Thank you for your reply.

The auditing permission is the meaning that, if you or anyone makes changes on OU object, it will be loged.

It will not log the changes on user account.

Yes, you should enable the auditing on user object.

Best Regards,
Daisy Zhou