AD Object Modified By

[twooly]

Any one knwo if an AD object has a modified by attribute?

I see whenChanged, whenCreated attributes but would also like an attribute showing who last modified it or created it. Does that exist?

Thanks in advance.

 

[shinedog]

Not on the object itself. You would need to search through domain controller security logs in order to find the event that corresponds to the object modification that you are looking for. Quite a PITA as depending on how fast your security logs wrap, the event you're looking for may have been purged by newer data before you even go looking for who modified what. AD auditing is one area where I think Active Directory just sucks. You pretty much need a 3rd party program to gather and organize this type of data. I think that functionality is in MOM? Dunno for sure.