Alert and Log showing a short SID instead of the user name for an event (4344616)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Alert and Log showing a short SID instead of the user name for an event
Description

Sometimes you will see some events that show "S-1-5-18" for User (Actor) field instead of the actual user name of user who triggered the event.
Cause

This is expected behavior for "Well Known Accounts".

For example, audited exchange events will often use the S-1-5-18 SID, which is the SID for the "Local System" account.
Resolution

Please see the following documentation from Microsoft on Well Known User Accounts:

https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/security-identifiers-in-windows

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title