LookupAccountSID takes a binary SID, not the text SID that commonly appears in NT Event Logs. You will first need to convert that text SID to binary and then feed it to LookupAccountSID. Here is some code to do that conversion:

sub SID_text2bin {
    my($text) = @_;

    my(@Values) = split(/\-/, $text);
    (@Values[0] == "S") or return;
    return pack("CCnnnV".(@Values-3), $Values[1], @Values-3, 0, 0, $Va
+lues[2], @Values[3..(@Values-1)]);
}
[download]

Dave