Event ID 5136

What Event ID 5136 Tells You

Event ID 5136 is valuable because it captures attribute-level directory changes, not just broad account or group activity. That makes it one of the clearest Windows audit records for seeing who changed an object, what part of the object was touched, and whether the change affected security-relevant settings such as permissions, delegation, or policy-linked attributes.

For defenders, the main value is forensic clarity. A 5136 record can help explain why access changed after the fact, but it only works well when directory service changes auditing is enabled and the right objects are being watched. Without that configuration, important modifications can happen quietly even though the event exists as a logging mechanism.

How Event ID 5136 Fits Active Directory Monitoring

Event ID 5136 sits inside the broader pattern of Active Directory change monitoring, where the goal is to track administrative actions that alter directory behaviour. It is especially useful on domain controllers because it reflects changes to directory objects in the authoritative copy of the environment, not merely local workstation activity.

This event is often used to identify changes that alter trust, access, or persistence. Those changes may include security descriptor updates, group policy-related modifications, or other object attribute edits that can affect how systems authenticate, authorise, or inherit permissions.

Because 5136 is attribute-focused, it complements other event IDs rather than replacing them. Teams usually correlate it with logon, privilege, and group membership telemetry to distinguish routine administration from suspicious changes that could enable persistence or broader access.

What to Look for in a 5136 Record

A useful 5136 event usually gives you enough detail to decide whether a change is benign, expected, or suspicious. The important question is not just that a directory object changed, but whether the changed attribute matches an operational task, a delegated change window, or an unusual administrative path.

Commonly relevant signals include edits to sensitive objects, repeated changes to the same object, modifications performed outside normal change windows, and updates that shift permissions or delegation in a way that expands access. Even a legitimate-looking change can matter if it affects a protected group, a policy object, or a security descriptor that governs downstream access.

For investigation, 5136 is strongest when paired with object context, change baselines, and surrounding audit records. That helps distinguish a real administrative update from noise, and it makes the log useful for both incident response and post-incident reconstruction.

Operational Value for Detection and Investigation

Event ID 5136 is most useful when defenders treat it as part of an audit strategy, not as a standalone alert. It supports detection engineering by providing a durable record of directory modification activity, which can be turned into alerts for high-value objects, unusual attribute patterns, or changes that often accompany privilege escalation and persistence.

It also has investigative value after compromise. If an attacker modified directory permissions, altered policy-linked settings, or changed a protected object, 5136 can help reconstruct that action even when the original intrusion path is unclear. That makes it an important source of evidence for understanding how access was expanded or maintained.

For practical monitoring, organisations should place 5136 alongside other directory service telemetry and ensure the collected data is retained long enough for retrospective analysis. If retention is too short, the event may exist only after the window in which anyone could still use it.

Risk and Threat Considerations

Directory attribute changes are attractive to attackers because they can quietly reshape access, policy, or trust relationships without immediately breaking normal operations. Event ID 5136 matters because it can reveal the kind of change that enables persistence, delegation abuse, or permission expansion in Active Directory.

Failure mechanism: If directory service changes auditing is incomplete, or if defenders do not review sensitive object changes, an attacker can modify security descriptors, group policy-linked settings, or other attributes and leave little immediate visible impact.

Impact: The result can be unauthorized access, hidden persistence, or policy abuse that survives long enough to support lateral movement, privilege escalation, or repeated re-entry.

Practitioner Guidance

Why practitioners should care: Event ID 5136 is most useful when it is tied to an explicit monitoring strategy for sensitive directory objects, because generic collection alone produces too much noise to be operationally reliable. The event becomes actionable when teams know which attributes and objects matter most in their environment.

What to watch for: Prioritise changes to protected groups, delegation-related attributes, security descriptors, and policy-linked objects, especially when the change source, timing, or change pattern does not fit normal administration. A small attribute edit can carry a large access consequence.

Practitioner takeaway: Treat 5136 as a change-detection primitive, then combine it with object criticality, baseline behaviour, and adjacent audit events before deciding whether the change is routine or suspicious.

Related resources from NHI Mgmt Group

• Guide: Active Directory Security Monitoring and Event IDs Guide
• Event ID 4742
• Sysmon Event ID 25
• Event ID 6903
• Event ID 4624