Home / server / Questions / 195540
Accepted
Jay Riggs
Asked: 2010-10-28 13:22:33 +0800 CST

Security Event Log: User field = N/A

  • 772

In my Windows Server 2008 R2 Enterprise Security Event Log all entries have 'N/A' for the "User:" field.

Is there something I can do to have this field filled in?

I noticed that this information is recorded in the message of the log entry; I'd just like to see this information in the User: field to make the log a bit easier to parse.

EDIT:
I'd like to see the "User:" field filled in for events associated with user logons and logoffs (so Event IDs 4624 and 4634, 4647).

windows-event-log windows-server-2008-r2

1 Answers

  1. Best Answer

    Not every event in the Security event log is associated with a user. For instance, the system time changing due to DST will generate an event in the Security event log, but the event is not associated with a user. What Event ID's are you looking at specifically?

    • 1