Forum

Ultimate Windows Security Forum » Security Log » 636 - Security Enabled Local Group Member... » EventID 636, missing member name

EventID 636, missing member name Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
aomething
Posted 9/27/2011 2:34:47 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/16/2011 11:35:48 AM
Posts: 1, Visits: 0
Trying to track back how (and who done it) a user was added to a group.

Found the EventID 636; however the Member Name field just displays a dash ( - ). Several users were added to the group, but it doesn't appear to be displaying any of the names. Is there a way to figure that information out?
Post #806
JavierC
Posted 10/11/2011 6:24:26 AM
Genius

GeniusGeniusGeniusGeniusGeniusGeniusGeniusGenius

Group: Forum Members
Last Login: 12/22/2011 4:55:21 PM
Posts: 12, Visits: 3
Hi,

The important part of event is SID ("target account id" and "member id"). If the account name includes a dash is because the machine had a problem resolving the sid to an account name. 

Try to resolve sid to a account name

Regards

Post #814
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 1:20pm