Filtering by objectGUIDSee original GitHub issue
I’m trying to write a filter against the
objectGUID attribute using the string representation of the GUID. Based on the article here: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 there is a pretty specific conversion that has to happen.
So in my case the objectGUID in string form is
F4C2CE4E-1F08-4358-ABDC-FE3F035AF4CD. According to the Microsoft documentation, to use this in a filter it needs to be converted to
\4e\ce\c2\f4\08\1f\58\43\ab\dc\fe\3f\03\5a\f4\cd so the final filter becomes:
Unfortunately, this isn’t returning any records for me. I just wanted to check and see if anyone has had success querying against the objectGUID field using the library. I wanted to rule out the ldapts library doing anything behind the scenes that might change or render obsolete some of the conversion steps.
Thank you in advance for any suggestions or advice!
- Created 2 years ago
- Comments:9 (4 by maintainers)