Event Details
User Activity->Account Management->Account Changes->Group Account Changes->Active Roles 7 or higher->EventID 1510 - Object is created.
EventID 1510 - Object is created.
Group Created
 Sample:
Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/21/2016 10:14:11 AM
Event ID:      1510
Task Category: ObjectCreate
Level:         Information
Keywords:      Classic,Audit Success
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
Object is created. 
Operation GUID: 3fe3fe0b-1bc9-41cf-bfb2-334632c18ad0 
Object name: InTrust.Admins 
Parent container: itss.wm.zhu.cn.qsft/OOUU 
Object class: group 
Object GUID: 5396bcb6-84ba-47a4-b143-aba050497ee0
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ARAdminService
Filtering Field Equals to Value
Source ARAdminSvc
EventId 1510
InsertionString4 group
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. - 1/1/2000
Who Account or user name under which the activity occured. - SomeUser
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Group Created" Group Created
Where The name of the workstation/server where the activity was logged. - 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. - High
WhoDomain -
WhereDomain -
Whom Account or user name being managed. Whom Robert.Gong
Group Type Type of group: security or distribution. -
Group Scope Scope of group: local, global, universal. -
Group Name -
Group Domain -
Affected Group -
Comments
You must be logged in to comment