Event Details
User Activity->Object Access->Active Directory Object Access->Active Roles 7 or higher->EventID 1517 - Attribute is modified.
EventID 1517 - Attribute is modified.
Attribute Modified
 Sample: 
Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/22/2016 10:11:51 AM
Event ID:      1517
Task Category: ObjectSetInfo
Level:         Information
Keywords:      Classic,Audit Success
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
Attribute is modified. 
Operation GUID: b1656271-9984-4b80-8ec5-2eac47aed1cc 
Attribute name: givenName 
Attribute value: Shawn 
Action: Replace
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ARAdminService
Filtering Field Equals to Value
Source ARAdminSvc
EventId 1517
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. - 1/1/2000
Who Account or user name under which the activity occured. - SomeUser
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Attribute Modified" Attribute Modified
Where The name of the workstation/server where the activity was logged. - 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. - High
WhoDomain -
WhereDomain -
Result Successful or Failed -
Object Name -
Object Type -
Whom -
Comments
You must be logged in to comment