detection.wiki

Microsoft-Windows-MCCS-AccountsRT

EventTitleChannelSampleRule
1Error: Error Location: Location Line Number: Line_Number.OperationalNN
2Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.OperationalNN

Event ID 1: Error: Error Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Provenance

ETW provider GUID dd2743c6-1722-4674-9f6f-c80044c4232e

Defined in AccountsRT.dll, which carries the event manifest.