Auditing universal group attribute changes in AD

I have a customer who recently reported that the "managed by" attribute of a few distros were changed. I checked the Exchange AdminAuditLog and don't see the change there.

I'd like to verify two things:

1. I've got AD auditing configured correctly to catch the attribute change (not membership change)
2. What event ID I should be looking for to see when "managed by" is changed

I've found a couple of blog posts (like this one) that describe auditing membership change. 

Thanks.