| KB ID: | 10041 |
| Last Revision: | November 26, 2006 |
| Version: | 1.0 |
Search: Find events when a change has been made to a group policy object.
When a group policy object is edited, what is found in your logs is the distinguished name of the GPO which makes it increasingly hard to find this event. On top of logging the distinguished name of the GPO for these logs, we log the name of the GPO as well, and let you search by the name you are familiar with for the GPO.
PREREQUISITES
The name of the group policy object.
ESTIMATED QUERY TIME
<1 second.
METHOD 1 (Quick Search)
1. Enter the name of the GPO in
the Quick Search field and click Go.
2. Find the corresponding log, and click on it to go to the
Detailed View of the log.
3. Click on the "versionNumber" attribute that is highlighted.
This will open up Log Fidelity GPO Tracker and you can view what
properties of this GPO got edited.
METHOD 2 (Advanced Search)
1. Enter the name of the GPO in
the Target Name field and click Submit.
2. Find the corresponding log, and click on it to go to the
Detailed View of the log.
3. Click on the "versionNumber" attribute that is highlighted.
This will open up Log Fidelity GPO Tracker and you can view what
properties of this GPO got edited.
If you do not know the name of the group policy object but have any information like when it was edited or who edited the group policy object, you can search for all instances when a group policy got edited by selecting the "versionNumber" attribute in the Advanced Search field.
LIKELY SCENARIOS IT APPLIES TO
- You want to find out who modified the group policy object when it changed.
- You want to find out what got modified in the group policy object when it got changed.
FINE TUNE YOUR SEARCH
If you know the time scope, domain of the edited objects, or want to restrict your searches to users in a specific domain you can fine tune your search.