3.2.4.1.5.3 Inserting SIDs and GUIDs
Services that write Event Log entries MAY record the identity of Active Directory objects (for example, users) and security principals as insertion strings in (respectively) GUID (as specified in [MS-DTYP] section 2.3.4) and SID format. The client MAY expand these GUIDs and SIDs into readable names of objects.<55>
If the client does not attempt to resolve SID or GUID insertion codes, or if resolving them fails for any reason, the client SHOULD quote SID and GUID strings verbatim.