Event ID 105 —

{
  "system": {
    "provider": "NTDS ISAM",
    "guid": "",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T17:08:18.628934+00:00",
    "event_record_id": 107,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Directory Service",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "NTDS",
      "664,D,0",
      "NTDSA: ",
      "0",
      "0",
      "\n[1] 0.000559 +J(0) +M(C:0K, Fs:85, WS:320K # 0K, PF:3268K # 336K, P:3268K)\n[2] 0.000295 +J(0) +M(C:16K, Fs:125, WS:496K # 276K, PF:292K # 292K, P:292K)\n[3] 0.000032 +J(0) +M(C:0K, Fs:5, WS:20K # 20K, PF:64K # 64K, P:64K)\n[4] 0.004285 -0.000162 (1) WT +J(0) +M(C:0K, Fs:117, WS:392K # 392K, PF:5996K # 5996K, P:5996K)\n[5] 0.000373 +J(0) +M(C:0K, Fs:5, WS:20K # 20K, PF:16K # 16K, P:16K)\n[6] 0.093356 +J(0) +M(C:0K, Fs:22, WS:84K # 84K, PF:16K # 16K, P:16K)\n[7] 0.406636 -0.392925 (21) WT +J(0) +M(C:0K, Fs:2579, WS:10296K # 10296K, PF:10260K # 10260K, P:10260K)\n[8] -\n[9] -\n[10] -\n[11] -\n[12] -\n[13] 0.052375 -0.044024 (22) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:8, WS:-10216K # 24K, PF:-10256K # 12K, P:-10256K)\n[14] 0.000024 +J(0)\n[15] 0.000367 +J(0) +M(C:0K, Fs:411, WS:1640K # 0K, PF:68K # 0K, P:68K)\n[16] 0.000609 -0.000144 (1) WT +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K)."
    ]
  },
  "message": ""
}