Who actually made the change in Local Group... Expand / Collapse
Author
Message
Posted 3/30/2016 7:23:47 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 4/4/2016 8:10:56 AM
Posts: 3, Visits: 15
The description of the event states:

To determine who actually made the rights assignment change you must search the domain controllers' security logs for changes to groupPolicyContainer objects (logged by Directory Service auditing).


This is good information and I was able to get additional information about Group Policy change from event 5136.

Is there a similar way to know who changed the Local Group Policy?

Thanks.
Post #5179
Posted 4/7/2016 7:52:31 AM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
I would start by looking for the same event on the system where the Local Policy was changed. Ensure that the logging configuration will log this event as well.
Post #5186
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:18pm