Windows EventInformation
Windows Event ID 5136 – Microsoft-Windows-Security-Auditing: Directory Service Object Modified
Event ID 5136 logs when Active Directory objects are modified, tracking changes to user accounts, groups, organizational units, and other directory objects for security auditing purposes.
