Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on active directory logs that have transformed to syslog messages like:

4662 Microsoft-Windows-Security-Auditing None Failure Audit domain.com Directory Service >Access An operation was performed on an object. Subject : Security ID: testuser$ >Account Name: testuser1$ Account Domain: NET Logon ID: 0x16c1f04444 Object: >Object Server: DS Object Type: %{bf967aba-0de6-11d0-a285-00aa003049e2} Object name: >%{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}

We are generating events in active directory that corresponds to a user printing to a printer in the directory. I was thinking the log sample corresponded to that event but I have not been able to interpret the ojbect names

My questions is how do you interpret the log messages in active directory when the object type and object name are formatted like %{bf967aba-0de6-11d0-a285-00aa003049e2} and %{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}? Is this a type of hash map to object names that have a more standard naming convention?

share|improve this question
3  
Well the IDs are definitely standard Microsoft GUIDs. My guess is they both map to the unique identifier for specific records in AD. Try running a query against the directory looking for these unique IDs. –  Brent Pabst Jan 10 '13 at 19:42
add comment

1 Answer

up vote 2 down vote accepted

According to [MS-ADSC]: Active Directory Schema Classes (http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-ADSC%5D.pdf), they are Active Directory schema class ID's:

  • bf967aba-0de6-11d0-a285-00aa003049e2 - user
  • e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 - dnsNode
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.