Lowercase full domain name: contoso.local For more information about SIDs, see Security identifiers.Īccount Name : the name of the account that requested the new logon session with explicit credentials.Īccount Domain : subject’s domain or computer name. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Note A security identifier (SID) is a unique value of variable length used to identify a trustee (security principal). If the SID cannot be resolved, you will see the source data in the event. Event Viewer automatically tries to resolve SIDs and show the account name. Security ID : SID of account that requested the new logon session with explicit credentials.

Minimum OS Version: Windows Server 2008, Windows Vista. Note For recommendations, see Security Monitoring Recommendations for this event. It is also a routine event which periodically occurs during normal operating system activity. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the “RUNAS” command.

This event is generated when a process attempts an account logon by explicitly specifying that account’s credentials.

Explicit hacked client