When creating a search using the Active Directory subsystem, the object picker uses the live AD data when trying to find an object. There is no option to search based on SID.
If you are trying to find audit events for an object that no longer exists, you can use the '* Like' filter found in the object picker by changing the scope to 'This Object' and entering part or all of the name, between asterisks in the field to the right of the “LIKE”. You can also create your search using the Add With Events option. Selecting Add With Events and then selecting the AD Subsystem will result in a list of objects being returned, for the specified time range, that have audit data in the database. The Add With Events options results in records being returned from the database.
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center