Won't that always show the SID of the user that created the process though? (threads can temporarily impersonate another user)
Another one might be when a network user changes a file on a share. Let's say this is running on the file server - presumably we get the local process name, and presumably it would be running as Network Service or similar, so we wouldn't get the user that actually made the change?