2 Replies Latest reply on Jun 30, 2016 3:34 PM by eastwood

    SIEM - Tracking when a computer is moved from OU to OU in Active Directory

    eastwood

      ESM Version 9.5.2

       

      I'm attempting to see who has been moving computers from one active directory OU into another OU.  I see nothing from domain controllers for Event ID 5139: A directory service object was moved.  I've attempted searching for "Microsoft-Windows-Security-Auditing 5139" under Signature ID, no results.  I am at a loss here, am I going at this the wrong way, or is this not possible?