r5662: eventlog uses dom_sid so it depends on security