In my Windows Server 2008 R2 Enterprise Security Event Log all entries have 'N/A' for the "User:" field.
Is there something I can do to have this field filled in?
I noticed that this information is recorded in the message of the log entry; I'd just like to see this information in the User: field to make the log a bit easier to parse.
EDIT:
I'd like to see the "User:" field filled in for events associated with user logons and logoffs (so Event IDs 4624 and 4634, 4647).