<110>2024-07-26T21:27:25.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = UserMgmtReports ]  [ REPORT_PROFILE = Locked out Users ]  [ USER_MGMT_TYPE = Account Locked ]  [ TIME_GENERATED = 1722043645 ]  [ FORMAT_MESSAGE = User account 'GuestAccount' was locked from computer 'NORDC-APP-EVTCO'. ]  [ ACCOUNT_NAME = GuestAccount ]  [ ACCOUNT_DOMAIN = null ]  [ ACCOUNT_SID = %{S-1-5-21-1725571127-999974082-2044928816-501} ]  [ CALLER_USER_NAME = NORDC-DC-03$ ]  [ CALLER_USER_DOMAIN = MDS-ATL ]  [ CALLER_LOGON_ID = 0x3e7 ]  [ SOURCE = nordc-dc-03.stark.com ]  [ EVENT_NUMBER = 4740 ]  [ REMARKS = A user account was locked out. ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ CALLER_MSTARKINE_NAME = NORDC-APP-EVTCO ]  [ RECORD_NUMBER = 1356219472 ]  [ CALLER_USER_SID = S-1-5-18 ]  [ ATTRIBUTES_TEXT = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ OPERATION_TYPE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = - ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = CN=GuestAccount,CN=Builtin,DC=stark,DC=com ]  [ ACCOUNT_NAME_OU_GUID = {4810DE86-553A-4038-AE1B-00E5212DE2C6} ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = null ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = null ]  [ CALLER_USER_OU_GUID = null ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = NORDC-APP-EVTCO ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ UAC_VALUE = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-07-26T21:27:25.000-04:00",
    "message": "<110>2024-07-26T21:27:25.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = UserMgmtReports ]  [ REPORT_PROFILE = Locked out Users ]  [ USER_MGMT_TYPE = Account Locked ]  [ TIME_GENERATED = 1722043645 ]  [ FORMAT_MESSAGE = User account 'GuestAccount' was locked from computer 'NORDC-APP-EVTCO'. ]  [ ACCOUNT_NAME = GuestAccount ]  [ ACCOUNT_DOMAIN = null ]  [ ACCOUNT_SID = %{S-1-5-21-1725571127-999974082-2044928816-501} ]  [ CALLER_USER_NAME = NORDC-DC-03$ ]  [ CALLER_USER_DOMAIN = MDS-ATL ]  [ CALLER_LOGON_ID = 0x3e7 ]  [ SOURCE = nordc-dc-03.stark.com ]  [ EVENT_NUMBER = 4740 ]  [ REMARKS = A user account was locked out. ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ CALLER_MSTARKINE_NAME = NORDC-APP-EVTCO ]  [ RECORD_NUMBER = 1356219472 ]  [ CALLER_USER_SID = S-1-5-18 ]  [ ATTRIBUTES_TEXT = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ OPERATION_TYPE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = - ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = CN=GuestAccount,CN=Builtin,DC=stark,DC=com ]  [ ACCOUNT_NAME_OU_GUID = {4810DE86-553A-4038-AE1B-00E5212DE2C6} ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = null ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = null ]  [ CALLER_USER_OU_GUID = null ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = NORDC-APP-EVTCO ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ UAC_VALUE = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}