2 Replies Latest reply on Jun 30, 2016 3:34 PM by eastwood

    SIEM - Tracking when a computer is moved from OU to OU in Active Directory


      ESM Version 9.5.2


      I'm attempting to see who has been moving computers from one active directory OU into another OU.  I see nothing from domain controllers for Event ID 5139: A directory service object was moved.  I've attempted searching for "Microsoft-Windows-Security-Auditing 5139" under Signature ID, no results.  I am at a loss here, am I going at this the wrong way, or is this not possible?