Audit log dsdb_group_json_audit with with "userSid": "S-1-5-18"

Rowland Penny rpenny at
Mon Nov 13 13:18:44 UTC 2023

On Mon, 13 Nov 2023 14:04:51 +0100
Cristian Galvani via samba-technical <samba-technical at>

> Right,
> is mapped to  'NT Authority\SYSTEM'
> Samba version 4.16.11 on all DCs

Strange, there was a problem where 'S-1-5-18' didn't get mapped, but I
thought it had been fixed.

If you run 'wbinfo -s S-1-5-18', does it produce this output:

NT Authority\SYSTEM 5


More information about the samba-technical mailing list