Time and again, I receive email notifications about such activities, for which I have no explanation.
The ID is not assigned to any user. I can’t find any corresponding keys in LAM either.
11. Juni 2026, 23:55
The administration has B0194126-4A53-487A-B0BC-6237EA07C926 added to group Domain Admins
12. Juni 2026, 01:00
The administration has B0194126-4A53-487A-B0BC-6237EA07C926 removed from group Domain Admins
I suspect this may be related to the NethVoice application.
As far as I know, NethVoice temporarily manages membership of the Domain Admins group because it needs elevated privileges to perform some user management operations. This can result in automated add/remove actions like the ones shown in your notifications.
The identifier itself may be an internal Nextcloud object UUID rather than a regular user account, which would explain why you cannot find a corresponding user or key in LAM.
This behavior is not ideal, and the NethVoice developers are working on a different approach that should avoid these temporary Domain Admins group modifications in future releases.
Can you confirm whether NethVoice is installed and in use on your system? If not, what applications are you using?
