According to this source
http://www.monitorware.com/en/events/details.asp?details_id=1865
Windows 2000's event id is 1573.
Todd
-Original Message-
From: Charlie Kaiser [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 16, 2004 6:34 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] When a
Interesting. I tend to get wrapped logs so I never noticed (or had reason
to notice specifically). What made you want to look Todd? I'm curious now.
Al
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Myrick, Todd
(NIH/CIT)
Sent: Thursday, June 17,
Interesting question. My expectation was that only the audit logs would
show this change. There is no app/ntds log entry that I've ever heard of.
If you're looking for a modified time stamp, you could look at the attribute
itself and see if it gives the info you're after.
Yee of little faith!
We will log this. I don't recall the event message on 2k, but 2k03 it
would be ID 16408 with text of something like: Domain operation mode
has been changed to Native Mode. The change cannot be reversed.
I *think* we log this (or something like it) on 2k as well, but I don't
It's the same for 2K3 native...
**
Charlie Kaiser
MCSE, CCNA
Systems Engineer
Essex Credit / Brickwalk
510 595 5083
**
-Original Message-
From: Eric Fleischman [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 16, 2004 3:02 PM
To: [EMAIL
