Hi,
I am trying to configure 2 monitoring filters:
1 for changes just to GPO
1 for users being added to to Domain Admin security groups.
I figured out how to monitor GPO however eventID 5136 also logs any changes to AD objects, how can I filter it to just ObjectType:GroupPolicyContainer?
for domain admin monitoring, I cannot figure out how to create a filter these logs?