detection.wiki

Microsoft-Windows-MCCS-ActiveSyncCsp

EventTitleChannelSampleRule
1Error: Error Location: Location Line Number: Line_Number.OperationalNN
2Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.OperationalNN

Event ID 1: Error: Error Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
Error
Location
Line_Number
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
Error_Propagated
Location
Line_Number
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Provenance

ETW provider GUID 602a0873-9bde-48b3-b6b7-277035293458

Defined in ActiveSyncCsp.dll, which carries the event manifest.