Track changes of AD objects with REPADMIN

Timestamps and changes of AD objects can be made visible with REPADMIN

A well-known problem for many administrators:
An error occured and when questioned what has been changed – of course ‘nothing has been changed’ will be the answer.

Using the “Active Directory Users and Computers” MMC console will only reveal time and date of the last change, but it will not show what was actually changed.

REPADMIN command to see changes of AD objects

Use the command REPADMIN to inspect the changes of individual LDAP attributes associated of objects with the time stamps on objects in Active Directory.

• USN (update sequence number)
• DC (Domain Controller) where changes were effected
• Time and date of the change
• Name of the LDAP attribute that has been change

Syntax:

Repadmin /showobjmeta <DomainController> “Distinguished Name of the Object“

Example:

Output: