Windows Security Log Event ID 5138

5138: A directory service object was undeleted

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event has not been observed.

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Mini-Seminars Covering Event ID 5138 Security Log Exposed: Auditing Changes, Deletions and Creations in Active Directory Filling the Gaps in Active Directory Monitoring Auditing Active Directory Changes with the Windows Security Log

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy