An AD object was moved to a different OU or container.
Moving objects out of OUs with protective GPOs (e.g., moving sensitive accounts to OUs without security policies, or moving objects out of admin-protected OUs).
Alert: objects moved out of high-security OUs or to unusual locations.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5139 // A directory service object was moved
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=5139
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A directory service object was moved — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
A directory service object was moved. An AD object was moved to a different OU or container.
Event 5139 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'DS Access' subcategory (Success and/or Failure).
Alert: objects moved out of high-security OUs or to unusual locations.