Issues resolving AD user SID with PowerShell EventLog - evt_resolve_ad_obj

[andrewnice]

Hi All, 

Does anyone know if it is possible to use the evt_resolve_ad_obj windows monitor parameter with the PowerShell event channel to resolve the Active Directory Security IDentifier (SID) to canonical name?

I know it works under the [WinEventLog://Security] stanza but it doesn't seem to work for me with the PowerShell stanza.

[WinEventLog://Microsoft-Windows-PowerShell/Operational]
disabled = 0
start_from = oldest
evt_resolve_ad_obj = 1
current_only = 0
checkpointInterval = 5
renderXml = 1
whitelist = 4104
index = powershell

A normal security event, 4688 for example, shows the SID under the <EventData> tag: 

<EventData> 
  <Data Name="SubjectUserSid">S-1-5-18</Data>
  ...
</EventData>

PowerShell events 4104 for example show the SID under the <System> tag: 

<System>
  ...
  <Security UserID="S-1-5-18" />
</System>

Not sure if this would cause it not to be able to extract it and resolve it or if anyone has this working?

Much appreciated.