Skip to content

Commit f09c877

Browse files
committed
utils: Add a describing link for not mapping case of capability SIDs
Signed-off-by: Hiroshi Hatake <[email protected]>
1 parent 2fae082 commit f09c877

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

ext/winevt/winevt_utils.cpp

+2-1
Original file line numberDiff line numberDiff line change
@@ -888,7 +888,8 @@ render_system_event(EVT_HANDLE hEvent, BOOL preserve_qualifiers, BOOL preserveSI
888888
}
889889
/* S-1-15-3- is used for capability SIDs. So, we need to skip
890890
* SID translation.
891-
* See also: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
891+
* ref: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
892+
* See also: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/sids-not-resolve-into-friendly-names
892893
*/
893894
if (strnicmp(pwsSid, "S-1-15-3-", 9) != 0) {
894895
if (ExpandSIDWString(pRenderedValues[EvtSystemUserID].SidVal,

0 commit comments

Comments
 (0)