When I look at my security log, it will show when a user has logged on and off. But I can't tell which user due to the logon ID is in hex language. ie.= New Logon: Security ID: INET\INET02-R$ Account Name: INET02-R$ Account Domain: INET Logon ID: 0x18b016 Logon GUID: {ec9d4a41-1481-eced-d153-a2db21d05fd8} How can I translate the Logon ID so the real logon name? Kind regards Karsten Laursen

Hi Karsten, The Logon ID is not something you can translate to a logon name. Logon ID is an ID code that is unique to that system and identifies the logon session. Here you can see an article describing it a little more in detail. It's old but still valid: http://technet.microsoft.com/en-us/library/cc751315.aspx Best Regards René

Thanks for the reply. Your answer leeds me to my next question: How can I see who have logged on to the domain?? I cant see any username where there is a lonon successfully in my security log. //Karsten

Do you have the Audit Logon Events enable? Take a look at this article to set it up: http://www.windowsecurity.com/articles/windows-active-directory-auditing.html /René

Do you have the Audit Logon Events enable? Take a look at this article to set it up: http://www.windowsecurity.com/articles/windows-active-directory-auditing.html /René

I have done that. We have found a method to see who has loged in, via a SQL search in our syslog.log But it is not easy. Thanks for the links.