Event-o-Pedia EventID 91 - LDAP query performed

	Event Details
	Operating System->Microsoft Windows->Application logs->Quest->Change Auditor->Change Auditor for Active Directory->ITAD Directory Changes->EventID 91 - LDAP query performed

EventID 91 - LDAP query performed

LDAP query performed.

Sample:

Event Type:     Information
Event Source:   ITAD Directory Changes
Event Category: None
Event ID:       91
Date:           10/30/2009
Time:           10:16:38
User:           RESEARCH\CBrown
Computer:       DC1
Description:    
LDAP query performed.
	Client Computer : fe80::cd9e:dae:292b:5e7f
	Object DN : CN=WIN-DD1AK8E1ES1,OU=Domain Controllers,DC=alicia,DC=local
	Object Class : computer
	Object GUID : {E1BA9F3E-5214-45FF-9325-04A6846273B5}
	Request ID : {08DA6999-601F-4702-9139-1910EBF87E89}
	Scope: Base
	Type: LDAP
	Results: 1
	Filter: (&(objectClass=*)(sAMAccountName=WIN-DD1AK8E1ES1$))
	Attribute Name: distinguishedName,uSNChanged,CN,serverReference,dNSHostName,servicePrincipalName,serverReferenceBL,objectGUID
	Elapsed: 0 ms

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

InTrust for AD

Filtering Field	Equals to Value
Source	ITAD Directory Changes
EventId	91

Field Matching

Field	Description	Stored in	Sample Value
DateTime	Date/Time of event origination in GMT format.	DateTime	10.10.2000 19:00:00
Source	Name of an Application or System Service originating the event.	Source	ITAD Directory Changes
Type	Warning, Information, Error, Success, Failure, etc.	-
User	Domain\Account name of user/service/computer initiating event.	User	RESEARCH\Alebovsky
Computer	Name of server workstation where event was logged.	Computer	DC1
EventID	Numerical ID of event. Unique within one Event Source.	EventId	591
Description	The entire unparsed event message.	Description	LDAP query performed.
Log Name	The name of the event log (e.g. Application, Security, System, etc.)	LogName	InTrust for AD
Category	A name for a subclass of events within the same Event Source.	Category	AttestationReview
Whom	The object name to which the activity was applied.	InsertionString1
Client Computer		InsertionString5	10.0.0.2
Request ID		InsertionString4	{3AA3DC84-20A6-4F6D-972F-7DF9C9F80272}
Object DN		InsertionString1	CN=Daniel Krane,CN=Users,DC=research,DC=corp
Object Class		InsertionString2	user
Object GUID		InsertionString3	{9DD9B58F-9548-4EE8-A852-7911C763BF7B}
Scope	Query scope. Can be Base, One level or Subtree	InsertionString6	Base
Number of results	Numeric, number of search results	InsertionString8	1
Filter	LDAP search filter string	InsertionString9	(&(objectClass=*)(sAMAccountName=WIN-DD1AK8E1ES1$))
Attribute Name	One or more attribute names separated by comma	InsertionString10	distinguishedName,uSNChanged,CN,serverReference,dNSHostName
Elapsed	Numeric, number of ms	InsertionString11	0 ms
Query Type	Query Type. Can be LDAP or GC	InsertionString7	GC