The group policy audit does not show changes made to gpo's. I have two domain controllers in a forest, one serving the root domain and the other serving a subdomain. The Splunk App for AD uses event 4662 which has embedded an Object Type and Object Name which is used in the following search macro:
eventtype=msad-ad-access Object_Type="groupPolicyContainer" | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | stats count values(Object_Name) by host
On one domain controller, the Object Type is properly stored on the indexer as groupPolicyContainer thus this search works properly. The Object Name is also correct. The other domain controller is sending just hex codes for the Object Type and Object Name, ie instead of the following entry
Object Type: groupPolicyContainer
Object Name: CN={135A1F9B-BECD-40CB-AA3E-FE24D39269A9}CN=Policies,CN=System,DC=na,DC=globomantics,DC=local
Instead it looks as follow:
Object Type: %{19195a5b-6da0-11d0-afd3-00c04fd930c9}
Object Name: %{b180120c-b7b5-4e90-bbe8-9def8d9492db}
This issue is very similar to a question asked "Splunk">http://splunk-base.splunk.com/answers/74609/splunk-for-ad-group-policy-changes-query">"Splunk for AD - Group Policy Changes Query
I am reasking the question because I wonder if I have misconfigured the windows server resulting in just hex being sent to the indexer and not a bug in the AD app.