Auditing Removal and Modification of AD Objects   

Can someone give me an article or answer a question on auditing specific user 
events:  I have enabled Object Access for Domain Controllers but how do I 
tell who moved a pc or user in another OU or deleted them? I see the generic 
event 560 when I tested and moved a user and a pc but it really doesn't 
explain what I did.  Is there a more specific way to find out what the user 
did when accessing the object?  Maybe I should already know this but a need 
does not come up until now.

Thank you,

date: Mon, 23 Jun 2008 12:36:00 -0700   author:   TeeCee

RE: Auditing Removal and Modification of AD Objects   

Using adsiedit.msc, there is an Audit tab int he Security property pages.  I 
haven't tried it yet though.

date: Wed, 25 Jun 2008 06:34:06 -0700   author:   fixitchris

RE: Auditing Removal and Modification of AD Objects   

Let me try and I will get back to you. Thank you.

"fixitchris" wrote:

> Using adsiedit.msc, there is an Audit tab int he Security property pages.  I 
> haven't tried it yet though.

date: Wed, 25 Jun 2008 06:46:03 -0700   author:   TeeCee