Event-o-Pedia EventID 1522 - Object is deprovisioned.

	Event Details
	User Activity->Object Access->Active Directory Object Access->Active Roles 7 or higher->EventID 1522 - Object is deprovisioned.

EventID 1522 - Object is deprovisioned.

Object Deprovisioned

Linked Event:

EventID 1522 - Object is deprovisioned.

Sample:

Object is deprovisioned.

Operation GUID: 641e329a-66f6-46fb-bb15-e7b56ec37195

Object name: Cecil Brown - Deprovisioned 10/22/2009

Parent container: research.corp/Users

Object class: user

Object GUID: d7218b46-064a-471d-bcfd-200f921e5a0f

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

ARAdminService

Filtering Field	Equals to Value
Source	ARAdminSvc
EventId	1522

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	-	1/1/2000
Who	Account or user name under which the activity occured.	-	SomeUser
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Object Deprovisioned"	Object Deprovisioned
Where	The name of the workstation/server where the activity was logged.	-	10.10.10.10
Where From	The name of the workstation/server where the activity was initiated from.	-	10.10.10.10
Severity	Specify the seriousness of the event.	-	High
WhoDomain		-
WhereDomain		-
Result	Successful or Failed	-
Object Name		-
Object Type		-
Whom		Whom	Cecil Brown - Deprovisioned 10/22/2009