<110>2024-06-30T22:37:48.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ADObjectsAuditReports ]  [ REPORT_PROFILE = All other AD Object changes ]  [ EVENT_NUMBER = 5141 ]  [ TIME_GENERATED = 1719801468 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ SOURCE = NORDC-DC-01.stark.com ]  [ REMARKS = DELETE : serviceConnectionPoint ]  [ OBJECT_SERVER = Active Directory Domain Services ]  [ OPERATION_TYPE = null ]  [ OBJECT_TYPE = null ]  [ OBJECT_TYPE_TEXT = serviceConnectionPoint ]  [ OBJECT_NAME = %{6ED74D3A-A7E9-458E-96D5-634A13B50B79} ]  [ OBJECT_NAME_TEXT = TSGateway ]  [ OBJECT_LOCATION_TEXT = stark.com/Corp-Computers/Servers/Terminal Servers (RDS)/RDPFarm1/TS03-2016/TSGateway ]  [ HANDLE_ID = null ]  [ PRIMARY_USER_NAME = null ]  [ PRIMARY_DOMAIN = stark.com ]  [ PRIMARY_LOGIN_ID = null ]  [ CLIENT_USER_NAME = TS03-2016$ ]  [ CLIENT_DOMAIN = MDS-ATL ]  [ CLIENT_LOGIN_ID = 0x42851672c ]  [ ACCESSES = DELETE ]  [ OBJECT_CLASS = null ]  [ OBJECT_CLASS_TEXT = serviceConnectionPoint ]  [ ATTRIBUTES = null ]  [ ATTRIBUTES_TEXT = null ]  [ ADDITIONAL_INFO = CN=TSGateway,CN=TS03-2016,OU=RDPFarm1,OU=Terminal Servers (RDS),OU=Servers,OU=Corp-Computers,DC=stark,DC=com ]  [ ADDITIONAL_INFO2 = null ]  [ ADDITIONAL_INFO2_TEXT = null ]  [ ACCESS_MASK = 0x10000 ]  [ FORMAT_MESSAGE = serviceConnectionPoint 'CN=TSGateway,CN=TS03-2016,OU=RDPFarm1,OU=Terminal Servers (RDS),OU=Servers,OU=Corp-Computers,DC=stark,DC=com' was deleted by 'MDS-ATL\TS03-2016$'.  ]  [ RECORD_NUMBER = 5939732745 ]  [ CALLER_USER_SID = S-1-5-21-1725571127-999974082-2044928816-39132 ]  [ ATTRIBUTES_VALUE = null ]  [ CORRELATION_ID = null ]  [ ATTRIBUTES_NEW_VALUE = null ]  [ ATTRIBUTES_OLD_VALUE = null ]  [ ATTRIBUTE_CATEGORY_ID = 1 ]  [ ACCOUNT_NAME = null ]  [ ACCOUNT_DOMAIN = null ]  [ ACCOUNT_SID = null ]  [ CALLER_USER_NAME = null ]  [ CALLER_USER_DOMAIN = null ]  [ CALLER_LOGON_ID = null ]  [ OBJECT_CATEGORY_TYPE = null ]  [ CONFIG_SUB_CATEGORY = null ]  [ ROOT_DOMAIN_NAMING_CONTEXT = null ]  [ CLIENT_SAM_ACCOUNT_NAME = null ]  [ CLIENT_DISPLAY_NAME = null ]  [ CLIENT_USER_PRINCIPAL_NAME = null ]  [ CLIENT_USER_GUID = null ]  [ CLIENT_DISTINGUISH_NAME = null ]  [ CLIENT_OU_GUID = null ]  [ CLIENT_USER_DEPARTMENT = null ]  [ CLIENT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = TS03-2016 ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = {C308CA2C-AEB7-4D59-AA90-5E3C010326C2} ]  [ CALLER_DISTINGUISH_NAME = CN=TS03-2016,OU=RDPFarm1,OU=Terminal Servers (RDS),OU=Servers,OU=Corp-Computers,DC=stark,DC=com ]  [ CALLER_USER_OU_GUID = {C95568BC-5154-450F-818A-803CC4883235} ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ ATTRIBUTE_SYNTAX = null ]  [ OP_APPLN_CORRELATION_ID = null ]  [ OP_CORRELATION_ID = null ]  [ OP_TREE_DELETE = No ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = CN=TS03-2016,OU=RDPFarm1,OU=Terminal Servers (RDS),OU=Servers,OU=Corp-Computers,DC=stark,DC=com ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ NEW_HANDLE_ID = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ ACTUAL_ATTR_NEW_VALUE = null ]  [ ACTUAL_ATTR_OLD_VALUE = null ] 
This is a syslog message from a product called ManageEngine ADManager by ManageEngine. The following fields were extracted from the message:
facilityCode: 13
facilityLabel: log audit
fieldExtractorName: ad_audit_plus
localHostname: Nordc-app-Dell
localStartTime: 2024-06-30T22:37:48.000-04:00
messageType: audit_log
priority: 110
program: ADAuditPlus
senderHost: 192.168.10.233
sensitivity: normal
severityCode: 6
severityLabel: informational
sourceInfo: unknown
streamName: ad_audit_plus
tags: ['rfc3164', 'ad_audit_plus', 'audit_log']