On some of our systems, Event Viewer shows a human-readable user name for the Event Log entries.

On other systems, Event Viewer shows an SID (in the form S-1-5-...).

Luckily, the SysInternals utility PSGETSID can be used to translate one to the other, but why is the user shown in different formats on the different systems?

It doesn't seem to be OS-specific, since we have two 64-bit Windows 7 systems that show the user differently (one shows the username, the other shows the SID).

Is this caused by security? Do you need a specific security right to be able to see the username in the Event Viewer?

1 Answer 1


I've seen this when the machine you are working on is unable to reach the Domain Controller.

  • This doesn't seem to be the problem. Thanks for the tip anyway.
    – Patrick
    Feb 22, 2011 at 16:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .