Audit log dsdb_group_json_audit with with "userSid": "S-1-5-18"

[Rowland Penny]

On Mon, 13 Nov 2023 14:04:51 +0100
Cristian Galvani via samba-technical <samba-technical at lists.samba.org>
wrote:

> Right,
> is mapped to  'NT Authority\SYSTEM'
> Samba version 4.16.11 on all DCs
> 

Strange, there was a problem where 'S-1-5-18' didn't get mapped, but I
thought it had been fixed.

If you run 'wbinfo -s S-1-5-18', does it produce this output:

NT Authority\SYSTEM 5

Rowland