Troubleshooting Guide › Collecting Audit Records › SID Resolution Times Out (Event Viewer Warning)

SID Resolution Times Out (Event Viewer Warning)

Valid on Windows

Symptom:

When I view the Application log of the Windows Event Viewer, I find a Warning event from CA ControlMinder that says that resolving a specific SID into an account name has timed out.

Solution:

A security identifier (SID) is a numeric value that identifies a user or group to the operating system. Each entry in the discretionary access control list (DACL) has an SID that identifies the user or group for whom access is allowed, denied, or audited.

This warning appears when the operating system was not able to convert the SID into an account name within the defined timeout. Make sure that the:

• Problematic system and its corresponding domain controller are configured correctly for SID resolution
• Network settings are configured correctly

You can also increase the timeout by changing the DefLookupTimeout configuration setting in the following registry key:

HKEY_LOCAL_MACHINE\Software\ComputerAssociates\AccessControl\SeOSD

Note: Increasing the SID resolution timeout may downgrade CA ControlMinder performance.