Microsoft-Windows-EDP-AppLearning
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 401 | An application tried to access enterprise resources | Admin | N | N |
| 402 | An enterprise resource was shared to a website | Admin | N | N |
Provenance
ETW provider GUID 9803daa0-81ba-483a-986c-f0e395b9f8d1
Defined in edpauditapi.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1882, captured 2026-06-02 — Manifest XML pack, 2.0 MB