Microsoft-Windows-Directory-Services-SAM-Utility
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | task_0Opcode_SamDatabaseChangeEvent | Operational | Y | N |
Event ID 1: task_0Opcode_SamDatabaseChangeEvent
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-Directory-Services-SAM-Utility/Operational",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 1180,
"thread_id": 10056
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 106,
"provider": "Microsoft-Windows-Directory-Services-SAM-Utility",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:33:56.941Z",
"version": 0
},
"event_data": {},
"message": ""
}
Provenance
ETW provider GUID bd8fea17-5549-4b49-aa03-1981d16396a9
Defined in samsrv.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1882, captured 2026-06-02 — Manifest XML pack, 2.0 MB