none
Who changed the GPO?

    Question

  • Hi Experts,

    Someone enabled Windows Update settings in a GPO which resulted in server reboots after the installation of updates which I need to trace. The Auditing is not enabled. The Event Logs are overwritten after certain size. The Event logs on the day the GPO was changed are overwritten.

    Info : Domain Admins do not login/RDP to DCs, they use Management Server where all administrative consoles are installed.

    Single Domain, single Forest with OS : W2012R2, DFL and FFL : 2012R2

    Is there a way to trace who has changed the GPO settings?

    Many thanks...

    Regards

    Dev


    testmonials

    Wednesday, July 15, 2015 1:16 PM

Answers

All replies