For more information on this issue and for a list of well-known SIDs that are defined in DSSL, click here.
what permissions to audit by checking Successful or Failed check boxes for the corresponding permissions. If a user name or a group name matches an SDDL abbreviation that is defined for a built-in group, a function that is called by the Group Policy Management Console treats the user name or the group name as a SID.
For example, this behavior occurs if you name a user or a group 'SA.' The 'SA' abbreviation corresponds to the SDDL security identifier (SID) string that represents the built-in Schema Admins group. Details: The network name cannot be found. The might not have the appropriate rights. This behavior occurs if a user or a group name that is referenced in a Group Policy Object corresponds to an abbreviation that is defined for a built-in group that is used by the Security Descriptor Definition Language (SDDL) format. Unable to edit Default Domain Policy : Failed to open group policy object.
