Windows Security Log Event ID 5136 not captured in InTrust

Question

Hi, 
 We are gathering all domain controller security logs. we have enabled domain controller auditing via GPO. 
 However when searching for particular event id 5136 is not displaying the repository report. This is happening after migrating intrust version 11 to 11.3. 
 2016 AD we are using for business. Is there any additional configuration required for capturing 5136: A directory service object was modified. Please assist,

Igor.Ilyin · Answer

Hi mcsebala, 
 No additional configuration required for capturing 5136. 
 First of all please check the event is there, I mean your GPO is correct and event 5136 can be observed in Windows EventViewer on that DC. 
 Second, which method of collecting do you use? If scheduled gathering via InTrust Manager, please check if any filters are in place in the gathering policy, they might prevent events from collecting. If you are using real-time collection via InTrust Deployment Manager, then events are collected without filters. 
 Third, check if you are searching in the right repository and also which filters are applied in the Repository Viewer. It's better to create the simplest filter, just 1. click on the root node in the tree on the left, 2. Click "Add or Remove Parameters" in the Search Filter at the bottom, 3. Pick "Event ID" from Primary category, 4. Type 5136 in "Event ID" filter box, 5. Click ">Go"

Igor.Ilyin · Answer

Hi mcsebala, 
 Sorry for delay, we've spent some time to prepare a tool for you. InTrust repository is a kind of storage intended to keep your data safe for years. So there is no such feature like delete/purge data from it. But you can copy the existing repository to another one with filters instead. Surely you need to provide plenty of space in the destination folder (at least equal to the current repository size). Please try the tool from the attachment. The example command might be the following: 
 RepositoryCopy.exe -j 5136 "\SERVER\SHARE\REPOSITORY" "\SERVER\SHARE\REPOSITORY-5136" 
 
 Run the tool and wait for the repository R EPOSITORY-5136 to be created 
 Attach it to the InTrust server, and if you use indexing wait until the indexing finished 
 Check that all data is in place 
 Switch the production to the new repository. The easiest way to do this is just substitute the path of the existing Repository configuration object, I mean go to your production Repository properties and change the path to the new one (e.g. "\SERVER\SHARE\REPOSITORY" => "\SERVER\SHARE\REPOSITORY-5136") 
 To make sure there was no data gap, you also might want to consolidate the data from the old repository to the new one for the period of transition, from the moment when you have started transition procedure to the moment when you have finished. 
 
 20191201-RepositoryCopy.zip 
 And please mark this thread as solved since you already know that Event ID 5136 can be easily captured by InTrust