[Samba] DSDB Audit of User Creation/Deletion on Samba DC

[Andrew Bartlett]

On Fri, 2022-02-25 at 08:30 -0600, Patrick Goetz via samba wrote:
> 
> On 2/24/22 17:06, Andrew Bartlett via samba wrote:
> > That really should be logged then.
> > 
> > No idea right now on what is going on, you will have to dig further.
> > 
> 
> Because I want a lot of stuff to happen automatically (e.g. add new user 
> to default groups, create a UNIX home directory, turn off password 
> expiration, etc.) I wrote a script to create new user accounts, which 
> then presumably isn't logged?

Correct.  You could force those over LDAP via -H to get them logged,
but you will need credentials. 

> That would seem like the normal use case.  I tried creating new users 
> using RSAT and found the experience underwhelming.

We know it is a weak point, but we don't have a good answer for this
part.

The audit code does run, but it is mixed into the debug stream and put
on stderr, and often overridden by the debug level of the command line
tools. 

Sorry,

Andrew Bartlett

-- 
Andrew Bartlett (he/him)        https://samba.org/~abartlet/
Samba Team Member (since 2001)  https://samba.org
Samba Developer, Catalyst IT    https://catalyst.net.nz/services/samba