Event Details
User Activity->Object Access->Active Directory Object Access->Active Roles 7 or higher->EventID 2692 - Operation has been successfully performed.
EventID 2692 - Operation has been successfully performed.
 Sample: 
Log Name:      ARAdminService
Source:        ARAdminSvc
Date:          11/29/2016 4:06:11 PM
Event ID:      2692
Task Category: Operation
Level:         Information
Keywords:      Classic
User:          ITSS\igor.ilyin
Computer:      IIZHU1.itss.wm.zhu.cn.qsft
Description:
Operation has been successfully performed  
Operation ID: 1-55 
Operation GUID: 447d1a59-8f3c-4057-9975-34a8bb3d4f85 
Operation: Modify Object 
Object name: InTrust.Admins 
Object parent container: itss.wm.zhu.cn.qsft/OOUU 
Object type: group 
Object GUID: 5396bcb6-84ba-47a4-b143-aba050497ee0 
Initiator: ITSS\igor.ilyin 
Operation reason:  
Details:  
	Attributes:
		member (append)
			CN=Robert.Gong,OU=OOUU,DC=itss,DC=wm,DC=zhu,DC=cn,DC=qsft
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: ARAdminService
Filtering Field Equals to Value
Source ARAdminSvc
EventId 2692
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. - 1/1/2000
Who Account or user name under which the activity occured. User RESEARCH\Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) Operation Modify Object
Where The name of the workstation/server where the activity was logged. - 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. - High
WhoDomain -
WhereDomain -
Result Successful or Failed -
Object Name Whom InTrust.Admins
Object Type Object type group
Whom InsertionString4 InTrust.Admins
Comments
You must be logged in to comment