Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on active directory logs that have transformed to syslog messages like:

4662 Microsoft-Windows-Security-Auditing None Failure Audit Directory Service >Access An operation was performed on an object. Subject : Security ID: testuser$ >Account Name: testuser1$ Account Domain: NET Logon ID: 0x16c1f04444 Object: >Object Server: DS Object Type: %{bf967aba-0de6-11d0-a285-00aa003049e2} Object name: >%{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}

We are generating events in active directory that corresponds to a user printing to a printer in the directory. I was thinking the log sample corresponded to that event but I have not been able to interpret the ojbect names

My questions is how do you interpret the log messages in active directory when the object type and object name are formatted like %{bf967aba-0de6-11d0-a285-00aa003049e2} and %{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}? Is this a type of hash map to object names that have a more standard naming convention?

share|improve this question
Well the IDs are definitely standard Microsoft GUIDs. My guess is they both map to the unique identifier for specific records in AD. Try running a query against the directory looking for these unique IDs. – Brent Pabst Jan 10 '13 at 19:42
up vote 2 down vote accepted

According to [MS-ADSC]: Active Directory Schema Classes (, they are Active Directory schema class ID's:

  • bf967aba-0de6-11d0-a285-00aa003049e2 - user
  • e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 - dnsNode
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.