Help Required on track active directory changes

I am going to write a small software to track active directory changes. I need an expert opinion from you. I want to display information about What ( with before and after values), When, Where and Who of any change in AD. I am going to implement this by one of the following way 1. Change Notification Control 2. DirSync Control

Both of these method give us the attribute that are changed and we can compare new values with some dump in SQL Server to get old values.

My problem is how can I find “Who” has made this change. I have tried but there is no attribute “LastModifiedBy” in active directory. Please give yo开发者_Python百科ur opinion how can I track who has made this change.

--Faisal Iqbal

My company uses ActiveRoles from Quest. No one actually makes changes directly to AD; all changes are done through ActiveRoles so we have that type of auditing (and a lot more benefits.)

Is there any reason you can't use AD Auditing?