Matthew, If you have auditing enabled on the domain controllers, you should have 566 events in the Security Log on the DC where the change was communicated. The Events are very cryptic and you will have to compare the Unique ID in the event with the Unique ID of the GPO. (If multiple GPOs were changed.) If you require auditing of the AD changes, I recommend a third party too. (Netpro has a nice one, but others may be better for your specific use.) Steve Stephen W. Tappmeyer Wintel Computing Citigroup North America Information Technology (NAIT) 1000 Technology Drive, MS 260 O'Fallon, Missouri, 63368-2240 Tel: 636.261.1490 Fax: 636-261-1500 Stephen.Tappmeyer@xxxxxxxxxxxxx _____ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Johnson, Matthew Sent: Thursday, May 31, 2007 10:09 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Who changed a gpo? How can I identify which user account changed a GPO? I was able to see under the details tab when it was last modified, but I need to figure out who changed it. Matthew Johnson CONFIDENTIALITY STATEMENT: This electronic message contains information from Fisher-Titus Medical Center and may be protected health information or other confidential and privileged information under law. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify the sender immediately by reply e-mail or telephone at 419/668-8101.