Windows Event ID 5137 – Microsoft-Windows-Security-Auditing: Directory Service Object Created

Navigate to Event Viewer to examine recent object creation events and identify patterns or anomalies.

1. Open Event Viewer on your domain controller
2. Navigate to Windows Logs → Security
3. In the Actions pane, click Filter Current Log
4. Enter 5137 in the Event IDs field and click OK
5. Review the filtered events, paying attention to the Object DN and Subject Account Name fields
6. Double-click specific events to view detailed information including object class and creation timestamp
7. Look for unusual creation patterns, such as bulk object creation outside normal business hours or objects created in unexpected OUs

Use PowerShell to perform advanced filtering and analysis of Event ID 5137 across multiple domain controllers.

1. Open PowerShell as Administrator on a domain controller or management workstation
2. Query recent object creation events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5137} -MaxEvents 100 | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='ObjectDN';Expression={$_.Properties[8].Value}}, @{Name='ObjectClass';Expression={$_.Properties[9].Value}}

3. Filter for specific object types:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5137} | Where-Object {$_.Properties[9].Value -eq 'user'} | Select-Object TimeCreated, @{Name='CreatedUser';Expression={$_.Properties[8].Value}}

4. Search across multiple domain controllers:

   $DCs = Get-ADDomainController -Filter *
   foreach ($DC in $DCs) {
       Write-Host "Checking $($DC.Name)..."
       Get-WinEvent -ComputerName $DC.Name -FilterHashtable @{LogName='Security'; Id=5137; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
   }

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5137; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\AD_Object_Creation_Report.csv" -NoTypeInformation

Implement comprehensive auditing policies to ensure Event ID 5137 captures all necessary object creation activities.

1. Open Group Policy Management Console on a domain controller
2. Navigate to your domain's Default Domain Controllers Policy or create a dedicated auditing GPO
3. Edit the policy and go to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
4. Expand DS Access and configure Audit Directory Service Changes to Success
5. For granular control, use auditpol.exe:

   auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable

6. Verify current audit settings:

   auditpol /get /subcategory:"Directory Service Changes"

7. Apply the policy using:

   gpupdate /force

8. Test the configuration by creating a test object and verifying Event ID 5137 appears in the Security log

Implement automated monitoring to detect suspicious object creation patterns and generate real-time alerts.

1. Create a PowerShell monitoring script:

   # Monitor-ADObjectCreation.ps1
   $LastCheck = (Get-Date).AddMinutes(-5)
   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5137; StartTime=$LastCheck}
   
   foreach ($Event in $Events) {
       $ObjectDN = $Event.Properties[8].Value
       $Creator = $Event.Properties[1].Value
       $ObjectClass = $Event.Properties[9].Value
       
       # Alert on suspicious patterns
       if ($ObjectClass -eq 'user' -and $Event.TimeCreated.Hour -lt 6) {
           Write-Warning "Off-hours user creation: $ObjectDN by $Creator"
           # Send alert email or log to SIEM
       }
   }

2. Schedule the script using Task Scheduler or run it as a Windows service
3. Configure Windows Event Forwarding to centralize Event ID 5137 collection:

   wecutil cs subscription.xml

4. Set up custom event log views in Event Viewer for quick access to object creation events
5. Integrate with SIEM solutions by configuring log forwarding or using Windows Event Collector
6. Create dashboard queries to visualize object creation trends and identify anomalies

Perform detailed forensic analysis of Event ID 5137 for security incident investigation and compliance reporting.

1. Collect comprehensive event data across all domain controllers:

   $StartDate = (Get-Date).AddDays(-90)
   $DCs = (Get-ADDomainController -Filter *).Name
   $AllEvents = @()
   
   foreach ($DC in $DCs) {
       try {
           $Events = Get-WinEvent -ComputerName $DC -FilterHashtable @{LogName='Security'; Id=5137; StartTime=$StartDate} -ErrorAction Stop
           $AllEvents += $Events
       } catch {
           Write-Warning "Could not retrieve events from $DC: $($_.Exception.Message)"
       }
   }

2. Analyze object creation patterns:

   $Analysis = $AllEvents | ForEach-Object {
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           Creator = $_.Properties[1].Value
           ObjectDN = $_.Properties[8].Value
           ObjectClass = $_.Properties[9].Value
           DC = $_.MachineName
       }
   } | Sort-Object TimeCreated

3. Generate compliance reports:

   $Analysis | Group-Object Creator | Select-Object Name, Count | Sort-Object Count -Descending | Export-Csv "ObjectCreationByUser.csv"

4. Correlate with other security events (4624, 4648) to build complete activity timelines
5. Use Event Log Explorer or similar tools for advanced filtering and correlation across multiple log sources
6. Document findings in incident response reports, including object creation timelines and responsible parties