deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-15 02:13:43 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update event-5136.md

Browse Source 
Added decription for %%14674 and %%14675 under operation type

fixes#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/11308
This commit is contained in:
Sriraman M S
2023-02-17 20:42:35 +05:30
committed by GitHub
parent bf8baf4715
commit d29087941e
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
windows/security/threat-protection/auditing/event-5136.md
View File

@ -212,9 +212,9 @@ For a change operation, you'll typically see two 5136 events for one action, wit
- **Type** \[Type = UnicodeString\]**:** type of performed operation.
- **Value Added** – new value added.
- **Value Added** – new value added ('%%14674')
- **Value Deleted** – value deleted (typically “Value Deleted” is a part of change operation).
- **Value Deleted** – value deleted ('%%14675', typically “Value Deleted” is a part of change operation).
<!-- -->
@ -236,4 +236,5 @@ For 5136(S): A directory service object was modified.
- If you need to monitor modifications to specific Active Directory attributes, monitor for **LDAP Display Name** field with specific attribute name.
- It's better to monitor **Operation\\Type = Value Added** events, because you'll see the new value of attribute. At the same time, you can correlate to previous **Operation\\Type = Value Deleted** event with the same **Correlation ID** to see the previous value.
- It's better to monitor **Operation\\Type = Value Added** events, because you'll see the new value of attribute. At the same time, you can correlate to previous **Operation\\Type = Value Deleted** event with the same **Correlation ID** to see the previous value.