# Winlogbeat displaying GUID in Windows events instead of object name

**URL:** <https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [January 12, 2017, 10:10pm UTC](https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442 "2017-01-12T22:10:53Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [January 13, 2017, 1:39pm UTC](https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442/5 "2017-01-13T13:39:35Z")

</div>

That is by design. Eventviewer only translate the GUID into an object. Try to run `Get-EventLog -LogName Security -Newest 500 | ? { $_.EventID -eq 4662} |Format-List` and you see that `ObjectName` is a GUID. You can get the object by `Get-ADObject xxxxxxxx-1111-2222-3333-yyyyyyyyyyyyy`. This is what the EventViewer is doing.

---

_[View the full topic](https://discuss.elastic.co/t/winlogbeat-displaying-guid-in-windows-events-instead-of-object-name/71442)._