# Winlogbeat read Windows Event id 4732 but not Member Security ID?

**URL:** https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759
**Category:** Beats
**Tags:** winlogbeat
**Created:** [January 9, 2023, 6:37pm UTC](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759 "2023-01-09T18:37:39Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![hansbrah7](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hansbrah7/32/115731_2.png) [@hansbrah7](https://discuss.elastic.co/u/hansbrah7)
#### Post date: [January 9, 2023, 6:37pm UTC](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759/1 "2023-01-09T18:37:39Z")

</div>

We have noticed that the Winlogbeat agent will read and ship up the event id 4732 (User added to local Security Group) but we noticed that it is missing the Member Security ID (which is the user that is getting added). In the Windows Event Log, we can see the Member - Security ID is cleartext but when ingesting into logstash we have the SID GUID instead.

Any way we can get the name instead of the SID?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eae23e5aa83e2ca18045ad86df412d90640ddf03.jpeg)

---

<div class="post-metadata">

### Author: ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)
#### Post date: [January 16, 2023, 3:42pm UTC](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759/2 "2023-01-16T15:42:27Z")

</div>

Hello,

On your event, could you click on Details \> XML View.  
What do you see for the mentioned field SID or name ?

What you see in the Event Viewer is not what is really shipped. this MMC likes to translate a lot of things to be more human readable, like SIDs -\> Samaccountname...  
The XML view is the real content of an event.

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 2, 2023, 3:06pm UTC](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759/3 "2023-02-02T15:06:32Z")

</div>

You can use the `translate_sid` processor.

> **[Translate SID | Winlogbeat Reference \[8.6\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/processor-translate-sid.html)**

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2023, 5:06pm UTC](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759/4 "2023-03-02T17:06:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.