Microsoft-Windows-Security-Adminless

Event	Title	Channel	Sample	Rule
1	Access to a resource would have been denied if run with the adminless …	Operational	N	N

Event ID 1: Access to a resource would have been denied if run with the adminless restriction at FailureTime (StackHash: StackHash).

Access to a resource would have been denied if run with the adminless restriction at %1 (StackHash: %2).

Name	Description
`FailureTime` FILETIME
`StackHash` HexInt32

ETW provider GUID ea216962-877b-5b73-f7c5-8aef5375959e

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB