| KB ID: | 10033 |
| Last Revision: | November 26, 2006 |
| Version: | 1.0 |
Search: Search events by attribute modified.
An event can also be defined by the attribute modified. For example when a group policy object gets edited, the attribute "versionNumber" is modified. If a mailbox is attached or detached from a user the "homeMDB" attribute is edited. Searching by the attribute modified is a powerful way to search for unique events in your domain.
PREREQUISITES
The type of object that was modified. If you do not know the name of the attribute that is modified, replicate the type of event and note which attribute gets modified. The attribute field is automatically populated to facilitate the process of searching by attribute.
ESTIMATED QUERY TIME
<1 second.
METHOD 1 (Advanced Search)
1. Select the Attribute from the drop down menu and click Submit.
LIKELY SCENARIOS IT APPLIES TO
- You want to find the events when a group policy object got modified.
- You want to find the events when a mailbox was created for a user.
FINE TUNE YOUR SEARCH
If you know the time scope, domain of the edited objects, or want to restrict your searches to users in a specific domain you can fine tune your search.