title: WinAPI LookupAccountSid from an .evt file
body: <p>I'm trying to get the user account name of a user SID  get from an .evt file (Event Log). Until now I have successfully read the file and I have access to the SID of the active user at the time the event was logged.  </p>
  
  <p>To get a user name from this SID I'm using the <strong>LookupAccountSid</strong> function :  </p>
  
  <pre><code>wstring userNameFromSid(SID  userSid,wstring computerName)
          {
              DWORD size = 256;
              wchar_t * buff = (wchar_t*)malloc(sizeof(wchar_t)*size);
              wchar_t * buffDomain = (wchar_t*)malloc(sizeof(wchar_t)*size);
              SID_NAME_USE SidType;
              wstring result;
              SID tmpSid = userSid;
  
              if(LookupAccountSid(computerName.c_str(), &amp;tmpSid, buff, &amp;size, buffDomain, &amp;size, &amp;SidType )){
                  result= buff;
              }
              else
              { 
                  /*Here some code to print error in a Message box*/
              }
  
              free(buff);
              free(buffDomain);
              return result;
          }
  </code></pre>
  
  <p>This works fine when I try on a local .evt file but many of my .evt file are from remote computers, and this is where is the problem. Indeed, when I try with a remote computer name, I get an <strong>ERROR_NONE_MAPPED</strong> code.<br>
  After numerous research, I still can not solve the problem (and this begin to be annoying)</p>
  
  <p><em>Note</em>:<br>
  I tried with a random false computer name to refine the problem and i get an <strong>error 1722 : The rpc server is unavailable</strong> witch was expected, so i'm able to connect the rpc (when i give the right name).  </p>
  
  <p>Thank you in advance,  </p>