Yubikey ID shown instead of Windows userid in some Events and syslog

[denlun44]

Hi!
Something I spotted digging through some syslog events was that the user field contained the domain\yubikeyid instead of domain\userid, but only on some events. I checked through the Windows Event Log and the same thing is there too.
One Windows Event that had it was EventID 40210, "Restore session has been initiated by 'DOMAIN\dskfhsdlkfjhasdkfjhsdaflsjadhflksdjh'.
It's a bit odd that it's right on EventID 110 and some others tho...
Is this by design?

/dennis

[david.domask]

Hi Dennis,

That doesn't sound quite correct; please open a Support Case and let Support review the situation. Cannot explain why the two events show different usernames (perhaps they use different method to retrieve it), but a Support case is the way to go.

Please share your case number here once created. Thanks!