Post a sample event on here and i'm sure either one of us will come up with the proper regex for you. I believe this is a known limitation right now for the extract field tool.
A lot of the log I had to cut out because of character limit.
msExchHideFromAddressLists=TRUE manager=CN=******\, Dan,OU=Technical Support,OU=Corporate Office,OU=CGS Users,DC=******,DC=local lastLogonTimestamp=12:20.04 PM, Mon 01/21/2013 dSCorePropagationData=\x3?\xE@?\x4&??V??~[?|$??YoX??y\x1C??O?\x1C| ??A\xF\x1F?\x3hS?4??U20121102172743.0Z|20121017184820.0Z|20121016140931.0Z|20121012204612.0Z|16010714223649.0Z mSMQDigests=\x3?\xE@?\x4&??V??~[?|$??YoX??y\x1C??O?\x1C| ??A\xF\x1F?\x3hS?4??U mSMQSignCertificates=\x3 lockoutTime=0 logonHours=<binary>