Troubleshooting Guide › Collecting Audit Records › SID Resolution Failed (Event Viewer Warning)

SID Resolution Failed (Event Viewer Warning)

Valid on Windows

Symptom:

When I view the Application log of the Windows Event Viewer, I find a Warning event from CA ControlMinder that says that resolving a specific SID into an account name has failed.

Solution:

A security identifier (SID) is a numeric value that identifies a user or group to the operating system. Each entry in the discretionary access control list (DACL) has an SID that identifies the user or group for whom access is allowed, denied, or audited.

This warning appears when the operating system was not able to convert the SID into an account name, for example, if the user or group that the SID refers to no longer exists. Make sure that the problematic system and its corresponding domain controller are configured correctly for SID resolution.