Auditing AD from Exchange Side. RRS feed

  • Question

  • Hi All,

    i have enabled Directory Service auditing in the environment, there is a security Event Log 5136 (Directory Service change).

    When as an Example, change the User Manager Field from AD Side, there are two Events (5136) created in the Security Log of this DC (one for the Old Manager Value and another for the New Manager Value).

    When i do the same but from the Exchange Server Side, There are two Event (5136) created in the connected DC (one for the Old Manager Value, but the other Event has an empty Value for the New Manager  Value).

    So does anyone has an explanation for this?

    Saturday, November 15, 2014 4:22 PM