All, Does anynone know why the user is N\A in s ecurity logs inwindows 2008 and is there a way to set it up. Thanks, Nosh

Hello, on lot's of entries in the event viewer there is no user name is shown as these events are not marked as that important. If you review all the entries, also for that event id, you should find one with the user name shown. I have searched this some weeks ago on one of my test machines. Unfortunal you can't do anything to enable it always.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi Meinolf, Thanks for the response. The issue, in fact is that there are no occurences of any user logs. Basically you can login to the console of the server and there is no USER ID on the security logs. thanks

Hi, For the user information, you need to check the event data of the security event. I've included an event for your reference: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 7/19/2010 12:04:08 PM Event ID: 4624 Task Category: Logon Level: Information Keywords: Audit Success User: N/A Computer: 2008CA.alone.local Description: An account was successfully logged on. Subject: Security ID: SYSTEM Account Name: 2008CA$ Account Domain: ALONE Logon ID: 0x3e7 Logon Type: 2 New Logon: Security ID: ALONE\administrator Account Name: administrator Account Domain: ALONE Logon ID: 0x114b16ba Logon GUID: {d09b69a9-dc5b-df9e-d9a9-4615f01e4cb0} Process Information: Process ID: 0xebc Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: 2008CA Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 Hope it helps.This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi This is the issue, as is also portayed on your reply. User: N/A We need to see the user ID such as "NMERNACAJ". What can we do to see the ID instead of N\A Thanks, Nosh

It turns out, Windows 2008 by design it does not show the user ID in the event viewer. Thanks, NoshNosh Mernacaj, Identity Management Consultant