Windows Security Log Event ID 5141

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Directory Service
 • Directory Service Changes
Type Failure
Corresponding events
in Windows 2003
and before

5141: A directory service object was deleted

On this page

This event documents deletion of AD objects, identifying the object deleted and user who deleted it. 

Of course this event will only be logged when the object's parent's audit policy has auditing enabled for deletion of the object class involved and for the user performing the action or a group to which the user belongs.

For users, groups and computers there are specific events for tracking deletion.  See "User account management", etc.

Free Security Log Resources by Randy

Description Fields in 5141


The user and logon session that deleted the object.

  • Security ID:  The SID of the account.
  • Account Name: The account logon name.
  • Account Domain: The domain or - in the case of local accounts - computer name.
  • Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.  Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Directory Service: 

  • Name: DNS name of the domain of the object
  • Type: "Active Directory Domain Services" or possibly other directory service if appropriate.  Maybe different value for ADAM or Lightweight Directory Services?


This is the object just deleted.  

  • DN: the X.400 distinguished name of the object
  • GUID: while "GUID" would indicate this should be the globally unique identifier of the object, as of Win2008 RC1 this event appears to just be the DN repeated
  • Class: the objectClass of the object as defined in the AD schema 


  • Tree Delete: Yes or No depending on whether the object deleted is a container object and the object and all its children were deleted.
  • Correlation ID: Multiple modifications are often executed as one operation via LDAP.  This value allows you to correlate all the modification events that comprise the operation.  Just look for other events with the same Correlation ID.
  • Application Correlation ID: Always "-"?  Unknown.  Start a discussion below if you have information on this

Setup PowerShell Audit Log Forwarding in 4 Minutes


Examples of 5141

A directory service object was deleted.


   Security ID:  ACME\administrator
   Account Name:  administrator
   Account Domain:  ACME
   Logon ID:  0x30999

Directory Service:

   Type: Active Directory Domain Services


   DN: CN={8F8DF4A9-5B21-4A27-9BA6-   1AECC663E843},CN=Policies,CN=System,DC=acme,DC=com
   GUID: CN={8F8DF4A9-5B21-4A27-9BA6-1AECC663E843}\0ADEL:291d5001-   782a-4b3c-a319-87c060621b0e,CN=Deleted Objects,DC=acme,DC=com
   Class: groupPolicyContainer


   Tree Delete: No
   Correlation ID: {140c9cef-8dc1-48f4-8b4a-de79230731a6}
   Application Correlation ID: -

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources