On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries.
On other systems, Event Viewer shows an SID (in the form S-1-5-...).
Luckily, the SysInternals utility PSGETSID can be used to translate one to the other, but why is the user shown in different formats on the different systems?
It doesn't seem to be OS-specific, since we have two 64-bit Windows 7 systems that show the user differently (one shows the username, the other shows the SID).
Is this caused by security? Do you need a specific security right to be able to see the username in the Event Viewer?