In some Application Contol log, [User] field is file path (same value as [Target] field) instead of user name.
Symantec Endpoint Protection 14.x
Broadcom is aware of this issue and will update this document when a solution becomes available.
If you use SEP client version 14.3 MP1 (14.3.1169.0100) and below, try to upgrade to 14.3 RU1 (14.3.3384.1000) and later to see whether the issue is gone or not. 14.3 RU1 includes partial fix to this issue.
ESCRT-7986