Microsoft-Windows-DCLocator
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | task_0 | Debug | N | N |
| 2 | task_02 | Debug | N | N |
| 3 | task_03 | Debug | N | N |
| 4 | task_04 | Debug | N | N |
| 5 | task_05 | Debug | N | N |
| 6 | task_06 | Debug | N | N |
| 7 | task_07 | Debug | N | N |
| 8 | task_08 | Debug | N | N |
| 9 | task_09 | Debug | N | N |
Provenance
ETW provider GUID cfaa5446-c6c4-4f5c-866f-31c9b55b962d
Defined in logoncli.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4946, captured 2026-06-02 — Manifest XML pack, 2.0 MB