What is the best way to find out if a GPO was modified and what change was made? I've tried PolicyModify and DomainPolicyModify with no luck.
I don't think the actual change that was done in GP will show up in the log will it? The closest I could come to see changes was by viewing the operational log under Event Viewer -> Applications & Services Log -> Microsoft -> Windows -> GroupPolicy. The messages still seem very generic to me.
Starting Audit Policy Configuration Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Domain Policy - New
Default Domain Controllers Policy
I hope you get this figured out as it would be very handy indeed. We usually uses GroupPolicyModify but mainly to track systems that failed at applying the newest GPO update..etc
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.