How to Find Out When an Object was Created in Active Directory

Authored by: Support.com Tech Pro Team

1. Introduction

How to Find Out When an Object was Created in Active Directory

2. Track Object Creation in Active Directory by Using Native Method

Below are the steps it takes to generate a report for when objects are created in Active Directory using native processes:

1. Group Policy Audit Settings – Configuration

In the Run window, type the command – gpmc.msc to open the Group Policy Management Console.

2. Editing the Default Domain Policy of the Domain

To edit the Group policy of a particular domain, simply select your domain, navigate to the “Default Domain Policy” and right click on it to select the “Edit” option.

3. Define the Settings for Audit Account Management Policy

In the left panel, navigate to Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy and double-click ‘Audit account management’

4. Selecting the Security Policy Setting Tab

Next, click the Security Policy Setting tab and select ‘Success’ under the “Audit these attempts” checkbox.

5. Configuration of ADSI

Expand ADSI Edit and the default naming context. Next, right click on the particular domain name and select Properties.

6. Navigate to Auditing Entry Window for Your Domain

In the DC properties window, navigate to the security tab and click Advanced. In the Advanced Security Settings, navigate to the Auditing tab and click Add. In the field – Enter the object name, write ‘Everyone’ and in the Auditing Entry, select “Create all child objects” and finally click OK.

7. Filtering the Security Event Log by Event ID 5137

Open Event Viewer, expand Windows Logs and select Security. In the “Filter Security Event Log” window, select the duration, event level and fill up the other necessary details along with Event ID – 5137 to get details on when an object was created.

8. Generating Details of the Event

To get more information on the event, Double-click on it to open the Event Properties Window.