{"id":4123,"date":"2026-06-08T18:01:28","date_gmt":"2026-06-08T15:01:28","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4123"},"modified":"2026-06-08T18:01:28","modified_gmt":"2026-06-08T15:01:28","slug":"security-events-reported-user-name-does-not-reflect-what-is-reported-in-the-windows-event-viewer","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/security-events-reported-user-name-does-not-reflect-what-is-reported-in-the-windows-event-viewer\/","title":{"rendered":"Security Events reported User name does not reflect what is reported in the Windows Event viewer"},"content":{"rendered":"<h3>Issue:<\/h3>\n<p>When looking at an forwarded Windows system event from the <strong>Events<\/strong> &gt; <strong>Security Events\u00a0<\/strong>page in the Elements portal, the reported user name shown in the <strong>Details\u00a0<\/strong>drop-down does not match what is reported in the file downloaded using the <strong>Event XML: Download XML<\/strong> link or the system event itself when looked locally from the Windows Event Viewer<\/p>\n<p>For example, in a Event ID: 4625 &quot;An account failed to log on&quot; event, The <strong>User Name<\/strong> and <strong>Principal User Name<\/strong> do not match with the actual account which failed to log on. Why is the wrong username listed in the detection details?\u00a0<\/p>\n<p>Other Event ID:s which have the same issue:\u00a0<\/p>\n<ul>\n<li>A user account was locked out. Event ID: 4740, event source: <span style=\"font-family: Courier New,Courier,monospace;\">Microsoft-Windows-Security-Auditing<\/span>.<\/li>\n<\/ul>\n<h3>Resolution:<\/h3>\n<p>The User name and Principal User Name in the\u00a0<strong>Details\u00a0<\/strong>section in the Security Alert do not refer to the affected user of the alert, they are just information taken from the\u00a0<strong>Device details\u00a0<\/strong>page in the portal of the last successfully logged in user.\u00a0<\/p>\n<p>You need to click on the\u00a0<strong>Event XML<\/strong>:\u00a0<strong>Download XML\u00a0<\/strong>link to view the details of the actual user for this system event.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When looking at an event under the Security Events&#8221; the reported user does not match what is reported in the events itself under windows event viewer<br \/>\nThe User Name and Principal User Name do not match with the actual locked out user.\u00a0<br \/>\n\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4123","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014694","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 15:01:28","import_hash":"ace5c9bb7da4ff35256b9f5e1b613790f46438d3","vanilla_article_id":32321,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32321-security-events-reported-user-name-does-not-reflect-what-is-reported-in-the-windows-event-viewer","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4123"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}