detection.wiki

Microsoft-Windows-DomainJoinManagerTriggerProvider

EventTitleChannelSampleRule
1task_0Opcode_DomainJoinEventOperationalNN
2task_0Opcode_DomainUnjoinEventOperationalNN

Event ID 1: task_0Opcode_DomainJoinEvent

#
Channel
Operational
Opcode
Opcode_DomainJoinEvent

Fields #

NameDescription
DomainMembershipChangeGuid GUID

Event ID 2: task_0Opcode_DomainUnjoinEvent

#
Channel
Operational
Opcode
Opcode_DomainUnjoinEvent

Fields #

NameDescription
DomainMembershipChangeGuid GUID

Provenance

ETW provider GUID 5b004607-1087-4f16-b10e-979685a8d131

Defined in lsasrv.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3804, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB