I am working on active directory logs that have transformed to syslog messages like:

4662 Microsoft-Windows-Security-Auditing None Failure Audit domain.com Directory Service >Access An operation was performed on an object. Subject : Security ID: testuser$ >Account Name: testuser1$ Account Domain: NET Logon ID: 0x16c1f04444 Object: >Object Server: DS Object Type: %{bf967aba-0de6-11d0-a285-00aa003049e2} Object name: >%{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}

We are generating events in active directory that corresponds to a user printing to a printer in the directory. I was thinking the log sample corresponded to that event but I have not been able to interpret the ojbect names

My questions is how do you interpret the log messages in active directory when the object type and object name are formatted like %{bf967aba-0de6-11d0-a285-00aa003049e2} and %{e0fa1e8c-9b45-11d0-afdd-00c04fd930c9}? Is this a type of hash map to object names that have a more standard naming convention?

  • 3
    Well the IDs are definitely standard Microsoft GUIDs. My guess is they both map to the unique identifier for specific records in AD. Try running a query against the directory looking for these unique IDs. Jan 10 '13 at 19:42

According to [MS-ADSC]: Active Directory Schema Classes (http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-ADSC%5D.pdf), they are Active Directory schema class ID's:

  • bf967aba-0de6-11d0-a285-00aa003049e2 - user
  • e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 - dnsNode

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.