The description for the eventlog entry looks like this: Object Operation: Object Server: DS Operation Type: Object Access Object Type: groupPolicyContainer Object Name: CN={5EAA131E-C35F-40B7-912D-14BD2FA5583F},CN=Policies,CN=System,DC=test,DC=local Handle ID: - Primary User Name: SERVER01$ Primary ...