Eventlog UserID don't contain SID but user name
There is bug in im_msvistalog.c (around line 560):
if (ConvertSidToStringSid(imconf->renderbuf[EvtSystemUserID].SidVal, &sidstr))
{
nx_logdata_set_string(logdata, "UserID", user); <<< There Should be sidstr instead of user
LocalFree(sidstr);
}
There is bug in im_msvistalog.c (around line 560):
if (ConvertSidToStringSid(imconf->renderbuf[EvtSystemUserID].SidVal, &sidstr))
{
nx_logdata_set_string(logdata, "UserID", user); <<< There Should be sidstr instead of user
LocalFree(sidstr);
}
Indeed, thanks!