Folder Details
User Activity->Policy Changes->InTrust Plug-in for Active Directory->Protected Change Attempts
Protected Change Attempts
This folder contains events related to requests to change Group Policy Objects that failed due to objects being protected from changes
Field Matching
FieldDescriptionSample Value
When At what date and time a user activity originated in the system. 1/1/2000
Who Account or user name under which the activity occured. SomeUser
What The type of activity occurred (e.g. Logon, Password Changed, etc.) AD Object Access
Where The name of the workstation/server where the activity was logged. 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. 10.0.0.2
Severity Specify the seriousness of the event. High
WhoDomain
WhereDomain
Policy Name The name of the affected policy.
GPO Name The name of GPO where some policy was changed Employees
Value Before The policy value before the change
Value After The policy value after the change
Result Successful or Failed Protected