Return
-
Title
Why is a SID received instead of a userid when using a real-time? -
Description
Why is a SID received instead of a userid when using a real-time alert? This only occurs when the userid is from another trusted domain and not the originating domain of the domain group. -
Resolution
This issue occurs because the system triggering the Real time alert is unable to resolve the SID because it does not belong to the domain in which this system resides. To verify this, go to the Event Viewer and event log of the system that triggered the event and verify that a SID is in the event.