I am working on active directory logs that have transformed to syslog messages like:
4662 Microsoft-Windows-Security-Auditing None Failure Audit domain.com Directory Service >Access An operation was performed on an object. Subject : Security ID: testuser$ >Account Name: testuser1$ Account Domain: NET Logon ID: 0x16c1f04444 Object: >Object Server: DS Object Type: %{bf967aba-0de6-11d0-a285-00aa003049e2} Object name: >%{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}
We are generating events in active directory that corresponds to a user printing to a printer in the directory. I was thinking the log sample corresponded to that event but I have not been able to interpret the ojbect names
My questions is how do you interpret the log messages in active directory when the object type and object name are formatted like %{bf967aba-0de6-11d0-a285-00aa003049e2}
and %{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}
? Is this a type of hash map to object names that have a more standard naming convention?