The user and logon session that performed the action.
- Security ID: The SID of the account.
- Account Name: The account logon name.
- Account Domain: The domain or - in the case of local accounts - computer name.
- Logon ID is a semi-unique (unique between reboots) number that identifies the logon session. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.
These fields tell you the program that registered the event source. Process ID is the process ID specified when the executable started as logged in 4688. The Process Name identifies the program executable.
Source Name: Name of the event source. This is the same as the Event Sources: field in the Filter dialog in EventViewer.Event Source ID: unknown. Start discussio below if you have information to share on this field!