GUID instead of DN

[PugazhendhiJ]

Hello,

I am using snare to get Wintel logs and I don’t find any issues except the event ID- 4662.  

I am  getting Server's  GUID instead  of Distinguish name in the logs.  It is tough to identify the host name.

Can anyone tell me why am I getting this.

[jeffshurtliff]

Hi Pugazhendhi,

I have moved this thread to the https://community.rsa.com/community/products/netwitness?sr=search&searchId=970fea69-e904-41f6-8905-13dc11ccd056&searchIndex=0‌ so that you can get an answer to your question.

Thanks,
Jeff

[SravanKoneti1]

Hi Pugazhendhi,

It is a Windows feature to show GUID instead the hostname. It benefits to show the same GUID even host has been renamed with new name. 

GUID of server looks fixed.

hostname may vary if renamed.

Windows admin may get the details of hostname using the GUID.

[PugazhendhiJ]

Hi Sarvan,

Thanks for your reply.

My query is not regarding the host name i am getting GUID instead of DN. 

For the particular event in Event viewer i am able to see the Distinguished name of the host when it comes to Decoder it showing GUID.

Is there anything need to done from my end to get the logs properly.

[SravanKoneti1]

Hi Pugazhendhi,

Can you share what you see in event viewer and the same log event from Netwitness investigation page?