https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45728#M1496 <P>Do you thing of this?</P> <P><A href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx</A></P> Mon, 26 Aug 2013 08:33:05 GMT HiroshiSatoh 2013-08-26T08:33:05Z https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45727#M1495 <P>Hi All!</P> <P>Could you tell me what SidType field means in WMI Security Event log?</P> <P>eg.</P> <P>01/17/2013 08:15:07 PM<BR /> LogName=Application<BR /> SourceName=Microsoft-Windows-User Profile Service<BR /> EventCode=1532<BR /> EventType=4<BR /> Type=Information<BR /> ComputerName=xxxxx<BR /> User=SYSTEM<BR /> Sid=S-1-5-18<BR /> <STRONG>SidType=5</STRONG><BR /> TaskCategory=None<BR /> OpCode=Info<BR /> RecordNumber=3523<BR /> Keywords=None<BR /> Message=The User Profile Service has stopped. </P> <P>Thank you</P> <P>brgds,<BR /> Adam</P> Mon, 26 Aug 2013 08:13:02 GMT https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45727#M1495 dadamsci 2013-08-26T08:13:02Z https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45728#M1496 <P>Do you thing of this?</P> <P><A href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx">http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx</A></P> Mon, 26 Aug 2013 08:33:05 GMT https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45728#M1496 HiroshiSatoh 2013-08-26T08:33:05Z https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45729#M1497 <P>Oh great, thank you! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 26 Aug 2013 08:53:15 GMT https://community.splunk.com/t5/Security/SidType-WMI-Security-Event-log/m-p/45729#M1497 dadamsci 2013-08-26T08:53:15Z