Event ID 326 —

{
  "system": {
    "provider": "NTDS ISAM",
    "guid": "",
    "event_source_name": "",
    "event_id": 326,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2022-04-07T17:08:18.628934+00:00",
    "event_record_id": 109,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Directory Service",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "NTDS",
      "664,D,50",
      "NTDSA: ",
      "1",
      "C:\\Windows\\NTDS\\ntds.dit",
      "0",
      "\n[1] 0.000035 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K)\n[2] 0.000508 -0.000194 (1) WT +J(0) +M(C:0K, Fs:19, WS:12K # 0K, PF:8K # 0K, P:8K)\n[3] 0.046828 -0.018928 (6) WT +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:17, WS:56K # 0K, PF:112K # 0K, P:112K)\n[4] 0.000119 +J(0)\n[5] -\n[6] -\n[7] -\n[8] 0.000937 -0.000295 (2) CM -0.000157 (2) WT +J(CM:2, PgRf:2, Rd:4/2, Dy:0/0, Lg:0/0) +M(C:16K, Fs:43, WS:164K # 0K, PF:212K # 0K, P:212K)\n[9] 0.084201 -0.083499 (9) CM -0.082701 (9) WT +J(CM:9, PgRf:24, Rd:0/9, Dy:0/0, Lg:0/0) +M(C:0K, Fs:32, WS:104K # 0K, PF:204K # 0K, P:204K)\n[10] 0.001274 -0.000927 (3) CM -0.000672 (3) WT +J(CM:3, PgRf:40, Rd:0/3, Dy:0/0, Lg:0/0) +M(C:0K, Fs:8, WS:24K # 0K, PF:64K # 0K, P:64K)\n[11] 0.000047 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K)\n[12] 0.000046 +J(CM:0, PgRf:48, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:2, WS:8K # 0K, PF:0K # 0K, P:0K)\n[13] 0.0 +J(0)\n[14] 0.0 +J(0)\n[15] 0.000003 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).",
      "0 0",
      "lgposAttach = 00000002:047E:0268,\ndbv = 1568.20.0 (8920)"
    ]
  },
  "message": ""
}