Audit log dsdb_group_json_audit with with "userSid": "S-1-5-18"

Mon Nov 13 13:24:24 UTC 2023

wbinfo -s S-1-5-18
produces as expected:
NT Authority\SYSTEM 5

what I can't understand is the origin of these activities that don't really
exist ;(

Il giorno lun 13 nov 2023 alle ore 14:19 Rowland Penny via samba-technical <
samba-technical at lists.samba.org> ha scritto:

> On Mon, 13 Nov 2023 14:04:51 +0100
> Cristian Galvani via samba-technical <samba-technical at lists.samba.org>
> wrote:
>
> > Right,
> > is mapped to  'NT Authority\SYSTEM'
> > Samba version 4.16.11 on all DCs
> >
>
> Strange, there was a problem where 'S-1-5-18' didn't get mapped, but I
> thought it had been fixed.
>
> If you run 'wbinfo -s S-1-5-18', does it produce this output:
>
> NT Authority\SYSTEM 5
>
> Rowland
>
>
>
>