Home / server / Questions / 238615
In Process
Patrick
Asked: 2011-02-23 04:43:46 +0800 CST

Why does the Windows Event Viewer sometimes show a human-readable user name, and sometimes an SID?

  • 772

On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries.

On other systems, Event Viewer shows an SID (in the form S-1-5-...).

Luckily, the SysInternals utility PSGETSID can be used to translate one to the other, but why is the user shown in different formats on the different systems?

It doesn't seem to be OS-specific, since we have two 64-bit Windows 7 systems that show the user differently (one shows the username, the other shows the SID).

Is this caused by security? Do you need a specific security right to be able to see the username in the Event Viewer?

windows windows-event-log eventviewer

1 Answers

  1. I've seen this when the machine you are working on is unable to reach the Domain Controller.

    • 1