detection.wiki

Microsoft-Windows-EDP-Audit-TCB

EventTitleChannelSampleRule
101Enterprise PreviousEnterpriseId tag has been removed (Policy) from the file: …AdminNN

Event ID 101: Enterprise PreviousEnterpriseId tag has been removed (Policy) from the file: FilePath.

#
Channel
Admin

Message #

Enterprise %4 tag has been removed (%2) from the file: %5

Fields #

NameDescription
UserId SID
Policy UnicodeString
Justification UnicodeString
PreviousEnterpriseId UnicodeString
FilePath UnicodeString

Provenance

ETW provider GUID 287d59b6-79ba-4741-a08b-2fedeede6435

Defined in edpauditapi.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1882, captured 2026-06-02 — Manifest XML pack, 2.0 MB