Skip to main content
AD Academy
Back to all events
5136Security (DC)GPO & policyWARNLast updated:

A directory service object was modified (including GPOs)

What it means

Records an attribute change on an AD object. Editing a GPO changes gPCFileSysPath/versionNumber — that is how you see who changed policy.

First steps

  1. 1Enable Audit Directory Service Changes or the event is never written.
  2. 2Compare Value Old/New to see exactly what changed.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.