user sid

[root]

hi,
two problems

-analizyng security log I have faund a user was modifying the SAM (resetting
password) I have the SID of the user bot I am not
able to find the username corresponding the SID how can I do ?
-is there any way to enable a "verbose logging" on some users?

thanks
Roberto

 

[Andrew Hodes]

Here's how you can find what user belongs to that SID:

http://www.jsiinc.com/SUBA/tip0200/rh0295.htm

As far as logging user actions, look into auditing events in your group
policy settings.