Is there a way to translate any GUID's to their corresponding AD objects as with "evt_resolve_ad_obj," but during Searchtime?
I would assume you could do it with a lookup (scripted or CSV) that does an LDAP search against your AD tree. From what I'm seeing here, objectGUID is an operational attribute of each object.
It's not perfect yet, but I got close using just ldapsearch, as follows:
ldapsearch -h my.ad.server -x -D "CN=bindaccount,CN=Users,DC=my,DC=com" -W -b DC=my,DC=com "(objectGuid=*)" distinguishedName objectGuid
This dumps (in ldif format) every object that has a GUID, showing its GUID and its DN. There's some non-entirely-trivial reformatting to turn this into a CSV for lookup purposes. The same thing might be more easily done with the Python LDAP modules: