Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries.

On other systems, Event Viewer shows an SID (in the form S-1-5-...).

Luckily, the SysInternals utility PSGETSID can be used to translate one to the other, but why is the user shown in different formats on the different systems?

It doesn't seem to be OS-specific, since we have two 64-bit Windows 7 systems that show the user differently (one shows the username, the other shows the SID).

Is this caused by security? Do you need a specific security right to be able to see the username in the Event Viewer?

share|improve this question

I've seen this when the machine you are working on is unable to reach the Domain Controller.

share|improve this answer
This doesn't seem to be the problem. Thanks for the tip anyway. – Patrick Feb 22 '11 at 16:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.