After updating our universal forwarders from 6.1.2 to 6.2.8 Windows Security logs are coming in without the Account_Name field populated. The SID is populated but that isn't nearly as useful as the username.
Have you tried forcing your inputs.conf stanza to resolve the ad names?
Maybe another app is now disabling that.
Try adding the following:
evt_resolve_ad_obj = 1
We are currently evaluating the impact of adding that stanza to the inputs.conf. I'll update when we have it implemented.