Event 5136

Hi David RODRIGUEZ,

You are spot on about how Event ID 5136 works in a multiple domain controller environment. This event is logged exclusively on the specific server that originally processed the LDAP modification request. When you rename an Organizational Unit, the Local Security Authority on the connected server processes the directory service change and immediately writes the audit record to its local Security Event Log. This behavior requires that your environment has the appropriate auditing enabled via Group Policy, specifically located at Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes.

Even though the new Organizational Unit name eventually replicates across your entire infrastructure, the audit event itself remains localized. Active Directory uses Update Sequence Numbers to silently update the directory database partitions on your other servers. Because those receiving domain controllers are simply syncing their internal databases rather than processing an interactive user modification, they bypass generating their own 5136 events for the replication cycle. This design prevents audit log flooding and ensures you can trace the exact origin of a directory alteration.

Hope this answer brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VP