Audit log dsdb_group_json_audit with with "userSid": "S-1-5-18"

[Rowland Penny]

On Mon, 13 Nov 2023 14:35:26 +0100
Cristian Galvani via samba-technical <samba-technical at lists.samba.org>
wrote:

> Problem found (I hope)
> The first thing is that is not a real problem, it a "samba-tool domain
> tombstones expunge" for testing in console I did "samba-tool domain
> tombstones expunge --tombstone-lifetime=10" and the output is the
> same of my first post
> 
> 

You are probably on the right track, though without seeing the logs it
is hard to say. What I can say is that 'SYSTEM' is the computer and the
computer must be doing 'something' and that's what is getting logged.

Rowland