[gptalk] Re: group policy changed - is there a log that shows this activity?

  • From: "Darren Mar-Elia" <darren@xxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Tue, 5 Sep 2006 08:25:02 -0700

Dan-
No, there are unfortunately no text logs that you can use to track what
changed in a GPO. If you have Directory Access Auditing enabled on your DCs,
then you should see a event with ID 566 in the security log on the PDC
emulator that will show a change to the groupPolicyContainer object in AD
that represents the GPO. That should also tell you who made the change, but
not what the change was.
 
Darren
 
 

  _____  

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of DSalmon@xxxxxxxxxxxxxxxx
Sent: Tuesday, September 05, 2006 8:21 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] group policy changed - is there a log that shows this
activity?


One of our group policies was recently changed but we don't know who did it.
This is a policy that only domain admins has the ability to change so it is
a very small group of people.  Most likely it was an accident but we want to
in fact verify this.  We have looked through the event logs but have found
no helpful information.  Are there text file logs or someplace else we can
look that will show us the changes or the times of the changes to the group
policies in question?
 
Thanks
Dan
 
 

Other related posts: