diff --git a/reactos/base/services/eventlog/file.c b/reactos/base/services/eventlog/file.c
index 8bd9ec0a159..a88b578572e 100644
--- a/reactos/base/services/eventlog/file.c
+++ b/reactos/base/services/eventlog/file.c
@@ -959,7 +959,7 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
     PEVENTLOGRECORD pRec;
     SYSTEMTIME SysTime;
     WCHAR *str;
-    UINT i, pos, nStrings;
+    UINT i, pos;
     PBYTE Buffer;
 
     dwRecSize =
@@ -983,7 +983,7 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
 
     dwRecSize += 4;
 
-    Buffer = (BYTE *) HeapAlloc(MyHeap, HEAP_ZERO_MEMORY, dwRecSize);
+    Buffer = HeapAlloc(MyHeap, HEAP_ZERO_MEMORY, dwRecSize);
 
     if (!Buffer)
     {
@@ -1002,7 +1002,6 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
 
     pRec->EventID = dwEventId;
     pRec->EventType = wType;
-    pRec->NumStrings = wNumStrings;
     pRec->EventCategory = wCategory;
 
     pos = sizeof(EVENTLOGRECORD);
@@ -1024,14 +1023,13 @@ PBYTE LogfAllocAndBuildNewRecord(LPDWORD lpRecSize,
     }
 
     pRec->StringOffset = pos;
-    for (i = 0, str = lpStrings, nStrings = 0; i < wNumStrings; i++)
+    for (i = 0, str = lpStrings; i < wNumStrings; i++)
     {
         lstrcpyW((WCHAR *) (Buffer + pos), str);
         pos += (lstrlenW(str) + 1) * sizeof(WCHAR);
         str += lstrlenW(str) + 1;
-        nStrings++;
     }
-    pRec->NumStrings = nStrings;
+    pRec->NumStrings = wNumStrings;
 
     pRec->DataOffset = pos;
     if (dwDataSize)
diff --git a/reactos/base/services/eventlog/rpc.c b/reactos/base/services/eventlog/rpc.c
index 1d4b7e9436a..9a2c868e545 100644
--- a/reactos/base/services/eventlog/rpc.c
+++ b/reactos/base/services/eventlog/rpc.c
@@ -397,6 +397,7 @@ NTSTATUS ElfrReportEventW(
     DWORD lastRec;
     DWORD recSize;
     DWORD dwStringsSize = 0;
+    DWORD dwUserSidLength = 0;
     DWORD dwError = ERROR_SUCCESS;
     WCHAR *lpStrings;
     int pos = 0;
@@ -439,10 +440,10 @@ NTSTATUS ElfrReportEventW(
                 DPRINT1("Type %hu: %wZ\n", EventType, Strings[i]);
                 break;
         }
-        dwStringsSize += (wcslen(Strings[i]->Buffer) + 1) * sizeof(WCHAR);
+        dwStringsSize += Strings[i]->Length + sizeof UNICODE_NULL;
     }
 
-    lpStrings = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY, dwStringsSize * 2);
+    lpStrings = HeapAlloc(GetProcessHeap(), 0, dwStringsSize);
     if (!lpStrings)
     {
         DPRINT1("Failed to allocate heap\n");
@@ -451,10 +452,14 @@ NTSTATUS ElfrReportEventW(
 
     for (i = 0; i < NumStrings; i++)
     {
-        wcscpy((WCHAR*)(lpStrings + pos), Strings[i]->Buffer);
-        pos += (wcslen(Strings[i]->Buffer) + 1) * sizeof(WCHAR);
+        CopyMemory(lpStrings + pos, Strings[i]->Buffer, Strings[i]->Length);
+        pos += Strings[i]->Length / sizeof(WCHAR);
+        lpStrings[pos] = UNICODE_NULL;
+        pos += sizeof UNICODE_NULL / sizeof(WCHAR);
     }
 
+    if (UserSID)
+        dwUserSidLength = FIELD_OFFSET(SID, SubAuthority[UserSID->SubAuthorityCount]);
     LogBuffer = LogfAllocAndBuildNewRecord(&recSize,
                                            lastRec,
                                            EventType,
@@ -462,10 +467,10 @@ NTSTATUS ElfrReportEventW(
                                            EventID,
                                            lpLogHandle->szName,
                                            ComputerName->Buffer,
-                                           sizeof(RPC_SID),
-                                           &UserSID,
+                                           dwUserSidLength,
+                                           UserSID,
                                            NumStrings,
-                                           (WCHAR*)lpStrings,
+                                           lpStrings,
                                            DataSize,
                                            Data);