- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to create a search for deleted OU?

mariorodriguez
Engager
07-29-2019
04:10 PM
Good day. Could you help me in the following situation?
I was informed that an OU had been removed from the active directory, which asked me to find who could have deleted it, look for the event code for that situation but I can't find the right search, so I would like help to see how I can find that information?
I hope I have been clear in the question
Thanks for the support.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
07-30-2019
05:42 AM
I believe you need to look for EventCode 5141 in your WinEventLog index. The OU in question must have auditing enabled. See https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=5141.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

mariorodriguez
Engager
07-30-2019
08:37 AM
thank you very much richgalloway, i will check
