MonitorWare Knowledge Base

Hi,

i want to check wit EventReporter the Event ID 637, the message was send to KIWI syslog Service Manager.

EVENT ID (637)
Security Enabled Local Group Member Removed:
Member Name: %1
Member ID: %2
Target Acc...

Now, in Windows Syslog the Member ID ist a Name for example Don\computer3.

In Syslog isnt the Name of the PC, that i removed, there was for example
this

%{s-34546-..........}% and so on, but i want see the Name not this number

CAN SOME ONE HELP ME

THANK YOU

Hi,

which EventReporter Version are you using?
EventReporter usually can resolve SID's from existing users & computers (And other objects). But if such an object was deleted, it's SID cannot be resolved anymore and then you will see the number

regards,
Andre

Also, a good check is to see if Windows Event Viewer can resolve these names. If it can't, Windows itself does not have this information anymore. Let us know if this succeeds.

Rainer Gerhards
Adiscon

I use the 6.3 Version of EventReporter

Here you see that Windows show me the Member ID:
http://www.poltorak.free-speicher.de/phpkit/Picture1.GIF

but when i send it to "Kiwi Syslog Service Manager" there was a Number not the real name
http://www.poltorak.free-speicher.de/phpkit/Picture.GIF

The post i mine with the version 6.3

Thanks for the screenshots.
For further help, could you enable Debug logging (Full Output), let EventRepoprter run for a while and send the debug log (packed with zip or rar) to support @ adiscon . com.

Then we can analyse this case further.

For your information. Currently, we are working on this issue. We have set up a test lab and have reproduce this behaviour. But we need some time to figure it out. I keep you up.