5139 Security log · DS Access medium severity low volume

Windows Event ID 5139 — A directory service object was moved

An AD object was moved to a different OU or container.

Why event 5139 matters

Moving objects out of OUs with protective GPOs (e.g., moving sensitive accounts to OUs without security policies, or moving objects out of admin-protected OUs).

How to detect it

Alert: objects moved out of high-security OUs or to unusual locations.

Log source
Security
Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 5139   // A directory service object was moved
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=5139
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A directory service object was moved — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 5139 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related DS Access events

4662 An operation was performed on an object 4928 An Active Directory replica source naming context was established 4929 An Active Directory replica source naming context was removed 4930 An Active Directory replica source naming context was modified 4932 Synchronization of a replica of an Active Directory naming context has begun 4933 Synchronization of a replica of an Active Directory naming context has ended 4934 Attributes of an Active Directory object were replicated 4935 Replication failure begins 4936 Replication failure ends 4937 A lingering object was removed from the replica 5136 A directory service object was modified 5137 A directory service object was created

Frequently asked questions

What is Windows Event ID 5139?

A directory service object was moved. An AD object was moved to a different OU or container.

Which log records event 5139?

Event 5139 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).

How do you detect activity around event 5139?

Alert: objects moved out of high-security OUs or to unusual locations.