[Samba] suspicious dsdb audit log entry conaining 0ADEL

[Rowland Penny]

On Wed, 18 Sep 2024 11:53:45 +0200
Tim Taylor via samba <samba at lists.samba.org> wrote:

> Hi all,
> 
> running an Samba-AD with
>    dsdb_json_audit:5
> in smb.conf perfectly for months, yesterday in the logs a messed up / 
> suspicious entry containing "CN=[...]\0ADEL:[someId]" as CN showed
> up.

I am surprised you couldn't find anything about that, because it is
well known, that record is a tombstone record, a record that is
deleted.

There is nothing to worry about, it will eventually disappear, in about
six months unless you use samba-tool to remove them.

Rowland