Audit log dsdb_group_json_audit with with "userSid": "S-1-5-18"

Rowland Penny rpenny at
Mon Nov 13 13:48:28 UTC 2023

On Mon, 13 Nov 2023 14:35:26 +0100
Cristian Galvani via samba-technical <samba-technical at>

> Problem found (I hope)
> The first thing is that is not a real problem, it a "samba-tool domain
> tombstones expunge" for testing in console I did "samba-tool domain
> tombstones expunge --tombstone-lifetime=10" and the output is the
> same of my first post

You are probably on the right track, though without seeing the logs it
is hard to say. What I can say is that 'SYSTEM' is the computer and the
computer must be doing 'something' and that's what is getting logged.


More information about the samba-technical mailing list