[Samba] kpasswd_samdb_set_password: domain\user (S-...) is changing password of user at domain

[Andrew Bartlett]

On Fri, 2018-09-14 at 13:00 -0400, Bill Baird via samba wrote:
> I have  dsdb_password_audit:5 & dsdb_password_json_audit:5 enabled,
> but I
> don't get the message I included.

Correct, that message is generated by a different system.

> I instead get an audit log that a password was changed...but not by
> who.

The userSid element should be the who.

> Was hoping to get more info in a single log entry, so I can track who
> on my
> staff is doing password resets and setup email alerts via my logging
> system.

Certainly, that is what this was built for.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba