GUID to AD Computer Object name

Question

Hi All&nbsp;I am&nbsp;a complete newbie to Log Analytics so don’t know if this is possible.&nbsp;I have been asked to query Analytics to see who and when Windows LAPS (Local Administrator Password Solution) has been accessed.&nbsp;&nbsp; Each time the Helpdesk staff use LAPs, event 4662 is generated on the DC and is uploaded.&nbsp;&nbsp; I have written the below basic query that returns the information that I need. But the ObjectName returns as a GUID (the event ID shows the GUID also).&nbsp; Is there away to translate that GUID to the computer object name from AD within Analytics?Hope you can help!Thanks!&nbsp;************* Query ****************SecurityEvent| where EventID == 4662| where AccountType == "User"| where Properties == "%%7688 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {771727b1-31b8-4cdf-ae62-4fe39fadf89e} &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {d659835a-c218-4cd3-a129-876324f81989} &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {bf967a86-0de6-11d0-a285-00aa003049e2} "| project TimeGenerated, Account, ObjectName&nbsp;************ Example output ***************TimeGenerated&nbsp;&nbsp; 2019-03-29T10:01:25.307Z&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Time and timeAccount:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Domain\John.doe&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Name of helpdesk staffObjectName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %{66f5f2dd-3081-4e29-8ete-da98ce2f67d4}&nbsp; #Computer object that was queried.

meir_mendelovich · Answer

Hi,You can't send LDAP requests from within Log Analytics queries. What you can do is to write a script that would rip the list of relevant objects from AD/AAD and will inject them into Log Analytics and then you can join them into this query. You can ingest the data using this API: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-collector-apiThanks,Meir :-&gt;

bscull · Answer

Thanks Meir!&nbsp;Brian.&nbsp;

Forum Discussion

GUID to AD Computer Object name

2 Replies

Resources