| KB ID: | 10047 |
| Last Revision: | November 26, 2006 |
| Version: | 1.0 |
Search: Find events when a user edited the permissions of an object.
The advantage of using Log Fidelity's solutions is that it takes all the need for Event IDs out of your hands. There are edits to an object that are logged with their respective IDs but majority of edits (along with reads and listing of properties) to objects in Active Directory is logged as one ID (ID: 566). This makes it impossible to find any logs where the ID isn't specifically assigned to that type of edit. With Log Fidelity's solution, we take away the need for the ID all together, and let you search by the type of information you would have in a real life scenario.
PREREQUISITES
The name of the object that was modified.
ESTIMATED QUERY TIME
<1 second.
METHOD 1 (Advanced Search)
1. Select the description "Write
Permissions".
2. Enter the name of the object in the Target Name field and click
Submit.
LIKELY SCENARIOS IT APPLIES TO
- You want to find the events when a group policy object got modified.
- You want to find the events when a mailbox was created for a user.
FINE TUNE YOUR SEARCH
If you know the time scope, domain of the edited objects, or want to restrict your searches to users in a specific domain you can fine tune your search.