Event-o-Pedia EventID 1512 - Object is modified.

	Event Details
	User Activity->Account Management->Account Changes->Computer Account Changes->Active Roles 7 or higher->EventID 1512 - Object is modified.

EventID 1512 - Object is modified.

Computer Modified

Linked Event:

EventID 1512 - Object is modified.

Sample:

Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/16/2016 2:37:01 PM
Event ID:      1512
Task Category: ObjectSetInfo
Level:         Information
Keywords:      Classic,Audit Success
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
Object is modified. 
Operation GUID: e2a05c64-981e-482b-a5b2-03492e18bf36 
Object name: Gary.Zheng 
Parent container: itss.wm.zhu.cn.qsft/OOUU 
Object class: user 
Object GUID: e1dd5b9f-20c6-4027-aa4b-1db1518276d3

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

ARAdminService

Filtering Field	Equals to Value
Source	ARAdminSvc
EventId	1512
InsertionString4	computer

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	-	1/1/2000
Who	Account or user name under which the activity occured.	-	SomeUser
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Computer Modified"	Computer Modified
Where	The name of the workstation/server where the activity was logged.	-	10.10.10.10
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	-	High
WhoDomain		-
WhereDomain		-
Whom	Account or user name being managed.	Whom	Gary.Zheng