Microsoft-Windows-EDP-Audit-Regular

Event	Title	Channel	Sample	Rule
201	DataInfo has been copied (Policy) from SourceAppName (tagged as …	Admin	N	N
301	Object has been changed from SourceName (tagged as SourceEnterpriseId) to …	Admin	N	N

Event ID 201: DataInfo has been copied (Policy) from SourceAppName (tagged as SourceEnterpriseId) to DestinationAppName (tagged as DestinationEnterpriseId).

%8 has been copied (%2) from %5 (tagged as %4) to %7 (tagged as %6)

Name	Description
`UserId` SID
`Policy` UnicodeString
`Justification` UnicodeString
`SourceEnterpriseId` UnicodeString
`SourceAppName` UnicodeString
`DestinationEnterpriseId` UnicodeString
`DestinationAppName` UnicodeString
`DataInfo` UnicodeString

%3 has been changed from %5 (tagged as %6) to %7 (tagged as %8) in %9

Name	Description
`UserId` SID
`Policy` UnicodeString
`Object` UnicodeString
`Action` UInt32
`SourceName` UnicodeString
`SourceEnterpriseId` UnicodeString
`DestinationName` UnicodeString
`DestinationEnterpriseId` UnicodeString
`ApplicationName` UnicodeString

ETW provider GUID 50f99b2d-96d2-421f-be4c-222c4140da9f

Defined in edpauditapi.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1882, captured 2026-06-02 — Manifest XML pack, 2.0 MB