Windows Security Log Event ID 5138

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Directory Service
 • Directory Service Changes
Type Success
Corresponding events
in Windows 2003
and before

5138: A directory service object was undeleted

On this page

This event has not been observed.

I haven't been able to produce this event. Have you? If so, please start a discussion (see above) and post a sample along with any comments you may have! Don't forget to sanitize any private information.

Free Security Log Resources by Randy

Supercharger Free Edition

Centrally manage WEC subscriptions.



Examples of 5138

A directory service object was undeleted.


   Security ID:  %3
   Account Name:  %4
   Account Domain:  %5
   Logon ID:  %6

Directory Service:

   Name: %7
   Type: %8


   Old DN: %9
   New DN: %10
   GUID: %11
   Class: %12


   Correlation ID: %1
   Application Correlation ID: %2

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources