Checking Who Applied GPO

Question

I know how to check what GPOs are applied on systems and users, but I'm wondering, is there a way to check who applied a specific GPO?

Answer 1

Meaning which admin set a GPO in the GPMC? You can with auditing, using tools like Netwrix or similar, or you can if you deploy the AGPM (https://technet.microsoft.com/en-us/windows/hh826067). You can also make sure DS auditing is enabled and look on the DC the change was made to (good luck!) and find event 566 I believe.

Personally, I like the 3rd party tool above, but it is expensive so it's for a larger shop. If you only have a few DCs you could setup something to alert you for event 566 entries on those DCs which would likely suffice.