Windows Event ID 5136 – Microsoft-Windows-Security-Auditing: Directory Service Object Modified

Start by examining the specific 5136 event details to understand what changed and who initiated the modification.

1. Open Event Viewer on your domain controller
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5136 using the filter option
4. Double-click the event to view detailed information
5. Review the following key fields:
   • Subject: Shows who made the change (Account Name and Account Domain)
   • Object: Displays the DN of the modified directory object
   • Attribute: Identifies which specific attribute was changed
   • Old Value and New Value: Shows before and after states
6. Note the timestamp and correlate with other security events if needed

Use PowerShell to efficiently search and analyze 5136 events across multiple domain controllers or time ranges.

1. Open PowerShell as Administrator on a domain controller
2. Query recent 5136 events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Filter events for specific objects or users:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136} | Where-Object {$_.Message -like "*CN=John Doe*"} | Select-Object TimeCreated, Message

4. Search for specific attribute changes:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136} | Where-Object {$_.Message -like "*memberOf*"} | Format-List TimeCreated, Message

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136; StartTime=(Get-Date).AddDays(-7)} | Export-Csv -Path "C:\Temp\AD_Changes.csv" -NoTypeInformation

Configure comprehensive directory service auditing to ensure all relevant changes generate 5136 events.

1. Open Group Policy Management Console on a domain controller
2. Edit the Default Domain Controllers Policy
3. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Expand DS Access and configure:
   • Audit Directory Service Changes: Enable Success and Failure
   • Audit Directory Service Access: Enable Success (optional, generates more events)
5. Apply the policy and run gpupdate /force on domain controllers
6. Verify auditing is active by checking the registry:

   Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics" -Name "5 Replication Events"

7. Test by making a test change to a user account and confirming 5136 events appear

Set up automated monitoring and alerting for critical 5136 events using SIEM or log management solutions.

1. Configure Windows Event Forwarding (WEF) to centralize 5136 events:

   wecutil cs subscription.xml

   Where subscription.xml contains your event collection configuration
2. Create custom event queries for high-priority changes:

   <QueryList>
     <Query Id="0">
       <Select Path="Security">*[System[EventID=5136]] and *[EventData[Data[@Name='AttributeLDAPDisplayName']='memberOf']]</Select>
     </Query>
   </QueryList>

3. Set up PowerShell-based alerting for critical changes:

   Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 5136" -Action { 
       # Alert logic here
       Send-MailMessage -To "admin@company.com" -Subject "Critical AD Change" -Body $Event.SourceEventArgs.NewEvent.Message
   }

4. Configure log retention policies to maintain audit trails:

   Limit-EventLog -LogName Security -MaximumSize 1GB -OverflowAction OverwriteAsNeeded

5. Create dashboards showing modification trends and anomalies

Perform detailed forensic analysis of 5136 events to investigate security incidents and track attack patterns.

1. Extract detailed event data using advanced PowerShell techniques:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5136; StartTime=(Get-Date).AddDays(-30)}
   $ParsedEvents = foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       [PSCustomObject]@{
           TimeCreated = $Event.TimeCreated
           SubjectUserName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'SubjectUserName'} | Select-Object -ExpandProperty '#text'
           ObjectDN = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'ObjectDN'} | Select-Object -ExpandProperty '#text'
           AttributeName = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'AttributeLDAPDisplayName'} | Select-Object -ExpandProperty '#text'
           OldValue = $XML.Event.EventData.Data | Where-Object {$_.Name -eq 'AttributeValue'} | Select-Object -ExpandProperty '#text'
       }
   }

2. Correlate with logon events (4624) to track user sessions:

   $LogonEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624}
   # Cross-reference timestamps and user accounts

3. Analyze patterns using timeline analysis:

   $ParsedEvents | Group-Object SubjectUserName | Sort-Object Count -Descending | Select-Object Name, Count

4. Check for privilege escalation indicators by monitoring group membership changes
5. Generate comprehensive reports for compliance and incident response:

   $ParsedEvents | Export-Csv -Path "C:\Forensics\AD_Modifications_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

6. Use tools like Microsoft's ATA or Azure ATP for advanced threat detection based on 5136 patterns