Event-o-Pedia EventID 1511 - Object is copied.

	Event Details
	User Activity->Account Management->Account Changes->Computer Account Changes->Active Roles 7 or higher->EventID 1511 - Object is copied.

EventID 1511 - Object is copied.

Computer copied

Linked Event:

EventID 1511 - Object is copied.

Sample:

Object is copied.

Operation GUID: 425b02da-fa6e-4f54-ad5d-fa2a0ecc2f7c

Name of copy object: Copy Cecil Brown

Parent container: research.corp/Users

Object class: user

Object GUID: 82507be2-4347-4109-828c-cc1585b66569

Original object: CN=Cecil Brown,CN=Users,DC=research,DC=corp

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

ARAdminService

Filtering Field	Equals to Value
Source	ARAdminSvc
EventId	1511
InsertionString4	computer

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	-	1/1/2000
Who	Account or user name under which the activity occured.	-	SomeUser
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Computer Copied"	Computer Copied
Where	The name of the workstation/server where the activity was logged.	-	10.10.10.10
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	-	High
WhoDomain		-
WhereDomain		-
Whom	Account or user name being managed.	Whom	CN=Cecil Brown,CN=Users,DC=research,DC=corp