... and lost access to TeamSite but still is OS user...
I think you got that backwards.. when SIDs appear, it's because TeamSite has an entity record that maps to a user that was removed from the OS or AD.
Thank u Rohan_t1 and rpoulin. But my second question is still not answered. A category folder had been accidentally moved inside a datatype folder of another category. I need to track who has moved or how it had happened. As i see, iwevents.log, doesnot record folder deletion/moving. Is there any way i can figure out how this folder had been moved? Thanks.