deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-27 00:03:45 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #7906 from MicrosoftDocs/repo_sync_working_branch

Browse Source 
Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/windows-itpro-docs (branch public)
This commit is contained in:
Stephanie Savell
2023-02-17 10:40:16 -06:00
committed by GitHub
parent ba888d6290 2d77438938
commit 2e58edb7ab
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
windows/security/threat-protection/auditing/event-5136.md
View File

@ -212,9 +212,9 @@ For a change operation, you'll typically see two 5136 events for one action, wit
- **Type** \[Type = UnicodeString\]**:** type of performed operation.
- **Value Added** – new value added.
- **Value Added** – new value added ('%%14674')
- **Value Deleted** – value deleted (typically “Value Deleted” is a part of change operation).
- **Value Deleted** – value deleted ('%%14675', typically “Value Deleted” is a part of change operation).
<!-- -->
@ -236,4 +236,5 @@ For 5136(S): A directory service object was modified.
- If you need to monitor modifications to specific Active Directory attributes, monitor for **LDAP Display Name** field with specific attribute name.
- It's better to monitor **Operation\\Type = Value Added** events, because you'll see the new value of attribute. At the same time, you can correlate to previous **Operation\\Type = Value Deleted** event with the same **Correlation ID** to see the previous value.
- It's better to monitor **Operation\\Type = Value Added** events, because you'll see the new value of attribute. At the same time, you can correlate to previous **Operation\\Type = Value Deleted** event with the same **Correlation ID** to see the previous value.