Issues with Splunk App for AD and Group policy changes not being listed

[coleman07]

The group policy audit does not show changes made to gpo's. I have two domain controllers in a forest, one serving the root domain and the other serving a subdomain. The Splunk App for AD uses event 4662 which has embedded an Object Type and Object Name which is used in the following search macro:

eventtype=msad-ad-access Object_Type="groupPolicyContainer" | eval adminuser=src_nt_domain."\".src_user | eval Object_Name=replace(Object_Name,"}CN","},CN") | stats count values(Object_Name) by host

On one domain controller, the Object Type is properly stored on the indexer as groupPolicyContainer thus this search works properly. The Object Name is also correct. The other domain controller is sending just hex codes for the Object Type and Object Name, ie instead of the following entry

Object Type: groupPolicyContainer
Object Name: CN={135A1F9B-BECD-40CB-AA3E-FE24D39269A9}CN=Policies,CN=System,DC=na,DC=globomantics,DC=local

Instead it looks as follow:

Object Type:        %{19195a5b-6da0-11d0-afd3-00c04fd930c9}
Object Name:        %{b180120c-b7b5-4e90-bbe8-9def8d9492db}

This issue is very similar to a question asked "Splunk for AD - Group Policy Changes Query

I am reasking the question because I wonder if I have misconfigured the windows server resulting in just hex being sent to the indexer and not a bug in the AD app.

[jbernt_splunk]

One possible fix, on the domain controllers, temporarily switch the user that the universal forwarder runs as, to a domain user (domain\user1, for example), restart Splunk, let it run for a few minutes, reset the user that Splunk runs as back to Local System and you should start seeing the Splunk_TA_windows ADMon stanza start showing. Also, in the Splunk_TA_windows/local/inputs.conf, make sure that you set ADMon to enabled. In WinEventLog://Security, make sure you set evt_resolve_ad_obj=1, so the GUIDs get translated in Splunk.

[jvargas80]

I'm having the same issue on a 2008 R2 domain. Running 2 DCs and 2008 R2 functional level. I'm getting hex values for the same two fields. Were you able to find a fix?