[gptalk] Re: Who changed a gpo?

  • From: "Tappmeyer, Stephen " <stephen.tappmeyer@xxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Thu, 31 May 2007 11:21:02 -0400


If you have auditing enabled on the domain controllers, you should have
566 events in the Security Log on the DC where the change was
communicated.  The Events are very cryptic and you will have to compare
the Unique ID in the event with the Unique ID of the GPO.  (If multiple
GPOs were changed.)


If you require auditing of the AD changes, I recommend a third party
too.  (Netpro has a nice one, but others may be better for your specific




Stephen W. Tappmeyer
Wintel Computing
Citigroup North America Information Technology (NAIT)
1000 Technology Drive, MS 260
O'Fallon, Missouri, 63368-2240
Tel: 636.261.1490
Fax: 636-261-1500


From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of Johnson, Matthew
Sent: Thursday, May 31, 2007 10:09 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Who changed a gpo?


How can I identify which user account changed a GPO?  I was able to see
under the details tab when it was last modified, but I need to figure
out who changed it.


Matthew Johnson

CONFIDENTIALITY STATEMENT: This electronic message contains information
from Fisher-Titus Medical Center and may be protected health information
or other confidential and privileged information under law.  The
information is intended to be for the use of the individual or entity
named above.  If you are not the intended recipient, be aware that any
disclosure, copying, distribution or use of the contents of this message
is prohibited. If you have received this electronic message in error,
please notify the sender immediately by reply e-mail or telephone at

Other related posts: