Audit log dsdb_group_json_audit with with "userSid": "S-1-5-18"

[Cristian Galvani]

Problem found (I hope)
The first thing is that is not a real problem, it a "samba-tool domain
tombstones expunge" for testing in console I did "samba-tool domain
tombstones expunge --tombstone-lifetime=10" and the output is the same of
my first post

Il giorno lun 13 nov 2023 alle ore 14:24 Cristian Galvani <
galvani.cristian at gmail.com> ha scritto:

> wbinfo -s S-1-5-18
> produces as expected:
> NT Authority\SYSTEM 5
>
> what I can't understand is the origin of these activities that don't
> really exist ;(
>
>
>
> Il giorno lun 13 nov 2023 alle ore 14:19 Rowland Penny via samba-technical
> <samba-technical at lists.samba.org> ha scritto:
>
>> On Mon, 13 Nov 2023 14:04:51 +0100
>> Cristian Galvani via samba-technical <samba-technical at lists.samba.org>
>> wrote:
>>
>> > Right,
>> > is mapped to  'NT Authority\SYSTEM'
>> > Samba version 4.16.11 on all DCs
>> >
>>
>> Strange, there was a problem where 'S-1-5-18' didn't get mapped, but I
>> thought it had been fixed.
>>
>> If you run 'wbinfo -s S-1-5-18', does it produce this output:
>>
>> NT Authority\SYSTEM 5
>>
>> Rowland
>>
>>
>>
>>
>
>
>

-- 
_______________________

Via Bruno Buozzi 24 - 43126 Parma (PR)
Cell: +39.339.2612261
M at il: galvani.cristian at gmail.com
_______________________