deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 06:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #11355 from msbemba/patch-35

Browse Source 
Update event-5136.md
This commit is contained in:
Vinay Pamnani 2023-02-17 11:05:17 -05:00 committed by GitHub
commit b6be2d87b8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
windows/security/threat-protection/auditing/event-5136.md
View File

@ -212,9 +212,9 @@ For a change operation, you'll typically see two 5136 events for one action, wit
- **Type** \[Type = UnicodeString\]**:** type of performed operation. - **Type** \[Type = UnicodeString\]**:** type of performed operation.
- **Value Added** – new value added. - **Value Added** – new value added ('%%14674')
- **Value Deleted** – value deleted (typically “Value Deleted” is a part of change operation). - **Value Deleted** – value deleted ('%%14675', typically “Value Deleted” is a part of change operation).
<!-- --> <!-- -->
@ -236,4 +236,5 @@ For 5136(S): A directory service object was modified.
- If you need to monitor modifications to specific Active Directory attributes, monitor for **LDAP Display Name** field with specific attribute name. - If you need to monitor modifications to specific Active Directory attributes, monitor for **LDAP Display Name** field with specific attribute name.
- It's better to monitor **Operation\\Type = Value Added** events, because you'll see the new value of attribute. At the same time, you can correlate to previous **Operation\\Type = Value Deleted** event with the same **Correlation ID** to see the previous value. - It's better to monitor **Operation\\Type = Value Added** events, because you'll see the new value of attribute. At the same time, you can correlate to previous **Operation\\Type = Value Deleted** event with the same **Correlation ID** to see the previous value.