detection.wiki

Microsoft-Windows-MCCS-AccountAccessor

EventTitleChannelSampleRule
1Error: Error Location: Location Line Number: Line_Number.OperationalNN
2Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.OperationalNN
100SPERF_TAG_AA_LOADStartOperationalNN
101SPERF_TAG_AA_LOADStopOperationalNN
102SPERF_TAG_AA_SAVEStartOperationalNN
103SPERF_TAG_AA_SAVEStopOperationalNN
151Being called to delete account P1_Dword, Is remote: P2_Boolean.OperationalNN
201Missing property P1_Dword in PopImap account creation.OperationalNN
202Should not delete property P1_Dword in PopImap account modification.OperationalNN
221PopImapAccountAccessor: Filling in default Dav info for account P1_Dword.OperationalNN
402CreateDefaultWindowsLiveAccount called.OperationalNN

Event ID 1: Error: Error Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 100: SPERF_TAG_AA_LOADStart

#
Channel
Operational
Task
SPERF_TAG_AA_LOAD
Opcode
Start

Event ID 101: SPERF_TAG_AA_LOADStop

#
Channel
Operational
Task
SPERF_TAG_AA_LOAD
Opcode
Stop

Event ID 102: SPERF_TAG_AA_SAVEStart

#
Channel
Operational
Task
SPERF_TAG_AA_SAVE
Opcode
Start

Event ID 103: SPERF_TAG_AA_SAVEStop

#
Channel
Operational
Task
SPERF_TAG_AA_SAVE
Opcode
Stop

Event ID 151: Being called to delete account P1_Dword, Is remote: P2_Boolean.

#
Channel
Operational

Message #

Being called to delete account %1, Is remote: %2.

Fields #

NameDescription
P1_Dword HexInt32
P2_Boolean Boolean

Event ID 201: Missing property P1_Dword in PopImap account creation.

#
Channel
Operational

Message #

Missing property %1 in PopImap account creation

Fields #

NameDescription
P1_Dword HexInt32

Event ID 202: Should not delete property P1_Dword in PopImap account modification.

#
Channel
Operational

Message #

Should not delete property %1 in PopImap account modification

Fields #

NameDescription
P1_Dword HexInt32

Event ID 221: PopImapAccountAccessor: Filling in default Dav info for account P1_Dword.

#
Channel
Operational

Message #

PopImapAccountAccessor: Filling in default Dav info for account %1

Fields #

NameDescription
P1_Dword HexInt32

Event ID 402: CreateDefaultWindowsLiveAccount called.

#
Channel
Operational

Provenance

ETW provider GUID 4025d192-273d-42ec-bdf8-940ec34eedca

Defined in AccountAccessor.dll, which carries the event manifest.