Id
Log location
Message
Fields
PackageIdentifier:
ErrorCode:
Commandline:
ErrorCode:
Provider Name:
Key Name:
Provider Name:
Key Name:
Algorithm Name:
KeyId:
Source: BTHUSB
EventData:
Source: BTHUSB
EventData:
Subject name of the leaf certificate is the first instance of the following path:
UserData/CertGetCertificateChain/CertificateChain/Certificate subjectName:
Subject name of the issuing certificate is the second instance of the following path:
UserData/CertGetCertificateChain/CertificateChain/ChainElement/Certificate
TrustStatus -> ErrorStatus: 1>
Source: Kernel-General
.
Source: BTHUSB
failed.
Data:
Source: WindowsUpdateClient
Security ID:
updateTitle:
updateGuid:
serviceGuid:
updateRevisionNumber:
Source: Kernel-Boot
.
LastBootGood:
Source: Kernel-Boot
OptionSelected:
Note: this event is recorded if the operating system was started in an auxiliary boot mode whereas its absence indicates the operating system started in normal boot mode.
UserData -> CertVerifyCertificateChainPolicy -> Certificate -> subjectName:
UserData -> CertVerifyCertificateChainPolicy -> Result -> value :
Security UserID:
OpCode:
Security UserID:
Security UserID:
Subject:
URI:
Allowed:
with error . The specific error text for this failure is: .
was started
User:
DeviceInstanceId:
Security ID:
SourceFolderPath: <%program files location%\
DestinationFolderPath: <%deleted program files location%\
.
Policy:
Policy:
.
UserID:
SubjectNames:
Thumbprint:
NotValidAfter: :
Subject:
Thumbprint:
Security ID:
Media type:
AutoProfiles:
Source: TPM-WMI
Keywords:
Source: User32
\systemreset.exe has initiated the restart of computer on behalf of user for the following reason: No title for this reason could be found
Reason Code: 0x20001
User:
Subcategory: Security State Change
Keywords:
percent full.
Keywords:
Keywords:
Source: ResetEng
Keywords:
Subcategory: Security State Change
Task category:
Keywords:
Subcategory: Logon
Security ID:
Account Name:
Account Domain:
Workstation Name:
Logon Type:
LogonID:
Source Network Address:
Subcategory: IPsec Main Mode
Task category:
Local Endpoint:
Remote Endpoint:
Keying Module Name:
Local Certificate:
Remote Certificate:
Cryptographic Information:
Keywords:
Subcategory: IPsec Main Mode
Task category:
Local Endpoint:
Remote Endpoint:
Keying Module Name:
Local Certificate:
Remote Certificate:
Cryptographic Information:
Keywords:
Subcategory: IPsec Main Mode
Task category:
Local Endpoint:
Remote Endpoint:
Keying Module Name:
Keywords:
Subcategory: Handle Manipulation
Security ID:
Object Name:
Access Mask:
Accesses:
Keywords:
Subcategory: Registry
entry change
Task category:
Security ID:
Object name:
Change Information:
Keywords:
Subcategory: Sensitive Privilege Use / Non Sensitive Privilege Use
Security ID:
Account Name:
Account Domain:
Keywords:
Subcategory: Audit Policy Change
Security ID:
Account Name:
Account Domain:
Login ID:
Task category:
Task Subcategory:
Subcategory GUID:
Changes:
Keywords:
Subcategory: User Account Management
Security ID:
Keywords:
Subcategory: Authentication Policy Change
Security ID:
Account Name:
Account Domain:
Task Category:
Changed Attributes:
Subcategory: User Account Management
Security ID:
Account Name:
Account Domain:
Subcategory: Logoff
Security UserID:
Account Name:
Account Domain:
Subcategory: Logon
Security ID:
Account Name:
Account Domain:
Subcategory: Audit Policy Change
Security ID:
Account Name:
Account Domain:
Login ID:
Policy Change Details:
Policy For Account:
Keywords:
Subcategory: MPSSVC Rule-Level Policy Change
Value:
Subcategory: System Integrity
Task category:
Subject:
Cryptographic Parameters:
Key file operation information:
Subcategory: Other Policy Change Events
Task category:
Change type:
Filter ID:
Filter Name:
Layer ID:
Layer Name:
Additional Information:
Subcategory: Filtering Platform Policy Change
Task category:
Change type:
Sub-layer ID:
Sub-layer Name:
Subcategory: IPsec Quick Mode
Task category:
Local Endpoint:
Remote Endpoint:
Keying Module Name:
Cryptographic Information:
Keywords:
Subcategory: System Integrity
Task category:
File Name: < file failing integrity check>
Subcategory: Filtering Platform Policy Change
Task category:
Change type:
Callout ID:
Callout Name:
Layer ID:
Layer Name:
Keywords:
Subcategory: Other Policy Change Events
Task category:
Change type:
Filter ID:
Filter Name:
Layer ID:
Layer Name:
Additional Information:
Subcategory: Filtering Platform Policy Change
Task category:
Change type:
Sub-layer ID:
Sub-layer Name:
to a wireless network
Network Adapter:
SSID: (non-TOE endpoint of connection)
Authentication: WPA2-Enterprise (protocol)
SSID: < Wireless network name> (non-TOE endpoint of connection)
Interface GUID: < network adapter identification>
SSID:
Interface GUID:
SSID:
was prevented from running.
Network Adapter:
Local MAC address:
Action:
Network Adapter:
Local MAC address:
Network Adapter:
Local MAC Address:
Applied Settings:
Source: UserPnP
for Device Instance ID
Security UserID:
DeviceInstanceID:
SetupClass:
Source: Bitlocker-Driver
of volume : completed
Security UserID:
Volume:
Source: Bitlocker-Driver
encountered a bad sector error.
Volume:
Source: BitLocker-Driver
.
Volume:
Source: Schannel
Protocol:
CipherSuite:
Source: Schannel
Reason for failureProtocol:
Description
Error Code Value
parameter
Boot critical file:
