detection.wiki

Microsoft-Windows-Security-Audit-Configuration-Client

EventTitleChannelSampleRule
100Group policy processing for audit settings initiated.DiagnosticNN
101Group policy processing for audit settings could not be started.OperationalNN
102List of applicable GPOs.OperationalYN
103Group policy processing for audit settings started.DiagnosticNN
104Failed to create local directory for downloading audit settings.OperationalNN
105Processing audit settings from the following GPO.DiagnosticNN
106Successfully downloaded the audit settings file as follows.DiagnosticNN
107Failed to downloaded the audit settings file as follows.OperationalNN
108Successfully configured the audit settings on the system.DiagnosticNN
109Failed to configure the audit settings on the system.OperationalNN
110Successfully generated RSoP data in WMI.DiagnosticNN
111Failed to generate RSoP data in WMI.OperationalNN
112Group policy processing for audit settings finished successfully.DiagnosticNN
113Group policy processing for audit settings finished with error.OperationalYN
114Successfully communicated the results of the operation to group policy engine.DiagnosticNN
115Failed to communicate the results of the operation to group policy engine.OperationalNN
200Group policy processing for central access policy settings initiated.DiagnosticNN
201Group policy processing for central access policy settings could not be started.OperationalNN
202List of applicable GPOs.OperationalNN
203Group policy processing for central access policy settings started.DiagnosticNN
204Failed to create local directory for downloading central access policy settings.OperationalNN
205Processing central access policy settings from the following GPO.DiagnosticNN
206Successfully downloaded the central access policy settings file as follows.DiagnosticNN
207Failed to downloaded the central access policy settings file as follows.OperationalNN
208Successfully configured the central access policy settings on the system.DiagnosticNN
209Failed to configure the central access policy settings on the system.OperationalNN
210Successfully generated RSoP data in WMI.DiagnosticNN
211Failed to generate RSoP data in WMI.OperationalNN
212Group policy processing for central access policy settings finished …DiagnosticNN
213Group policy processing for central access policy settings finished with error.OperationalNN
214Successfully communicated the results of the operation to group policy engine.DiagnosticNN
215Failed to communicate the results of the operation to group policy engine.OperationalNN

Event ID 100: Group policy processing for audit settings initiated.

#
Channel
Diagnostic
Opcode
Start

Event ID 101: Group policy processing for audit settings could not be started.

#
Channel
Operational
Opcode
Stop

Description

Group policy processing for audit settings could not be started. Error: ErrorCode.

Message #

Group policy processing for audit settings could not be started. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 102: List of applicable GPOs.

#
Channel
Operational
Level
Informational

Message #

List of applicable GPOs:
%1

Fields #

NameDescription
GPOList UnicodeStringList of applicable GPOs

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Audit-Configuration-Client",
    "guid": "08466062-AED4-4834-8B04-CDDB414504E5",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T23:49:58.045589+00:00",
    "event_record_id": 40,
    "correlation": {
      "ActivityID": "AA63BEC0-3996-4133-A97D-DB5DB9617FF3"
    },
    "execution": {
      "process_id": 8540,
      "thread_id": 9876
    },
    "channel": "Microsoft-Windows-Security-Audit-Configuration-Client/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "GPOList": "Local Group Policy\n"
  },
  "message": ""
}

References #

Event ID 103: Group policy processing for audit settings started.

#
Channel
Diagnostic
Opcode
Start

Event ID 104: Failed to create local directory for downloading audit settings.

#
Channel
Operational

Description

Failed to create local directory for downloading audit settings. Error: ErrorCode.

Message #

Failed to create local directory for downloading audit settings. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 105: Processing audit settings from the following GPO.

#
Channel
Diagnostic

Message #

Processing audit settings from the following GPO.
Display Name: %1
GPO ID: %2
SYSVOL Path: %3

Fields #

NameDescription
GPOName UnicodeString
GPOID UnicodeString
SysvolPath UnicodeString

Event ID 106: Successfully downloaded the audit settings file as follows.

#
Channel
Diagnostic

Message #

Successfully downloaded the audit settings file as follows.
Remote File: %1
Local File: %2
GPO Name: %3

Fields #

NameDescription
RemoteFile UnicodeString
LocalFile UnicodeString
GPOName UnicodeString

Event ID 107: Failed to downloaded the audit settings file as follows.

#
Channel
Operational

Message #

Failed to downloaded the audit settings file as follows.
Remote File: %1
Local File: %2
GPO Name: %3
Error: %4

Fields #

NameDescription
RemoteFile UnicodeString
LocalFile UnicodeString
GPOName UnicodeString
ErrorCode UInt32

Event ID 108: Successfully configured the audit settings on the system.

#
Channel
Diagnostic

Event ID 109: Failed to configure the audit settings on the system.

#
Channel
Operational

Message #

Failed to configure the audit settings on the system.
Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 110: Successfully generated RSoP data in WMI.

#
Channel
Diagnostic

Event ID 111: Failed to generate RSoP data in WMI.

#
Channel
Operational

Description

Failed to generate RSoP data in WMI. Error:ErrorCode.

Message #

Failed to generate RSoP data in WMI. Error:%1

Fields #

NameDescription
ErrorCode UInt32

Event ID 112: Group policy processing for audit settings finished successfully.

#
Channel
Diagnostic
Opcode
Stop

Event ID 113: Group policy processing for audit settings finished with error.

#
Channel
Operational
Opcode
Stop

Description

Group policy processing for audit settings finished with error. Error: ErrorCode.

Message #

Group policy processing for audit settings finished with error. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Audit-Configuration-Client",
    "event_id": 113,
    "level": "Error",
    "task": null,
    "opcode": "Stop",
    "time_created": "2026-05-27T17:42:31.5884058+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
  },
  "event_data": {
    "ErrorCode": "2147944105"
  }
}

Event ID 114: Successfully communicated the results of the operation to group policy engine.

#
Channel
Diagnostic

Event ID 115: Failed to communicate the results of the operation to group policy engine.

#
Channel
Operational

Description

Failed to communicate the results of the operation to group policy engine. Error: ErrorCode.

Message #

Failed to communicate the results of the operation to group policy engine. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 200: Group policy processing for central access policy settings initiated.

#
Channel
Diagnostic
Opcode
Start

Event ID 201: Group policy processing for central access policy settings could not be started.

#
Channel
Operational
Opcode
Stop

Description

Group policy processing for central access policy settings could not be started. Error: ErrorCode.

Message #

Group policy processing for central access policy settings could not be started. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 202: List of applicable GPOs.

#
Channel
Operational

Message #

List of applicable GPOs:
%1

Fields #

NameDescription
GPOList UnicodeString

Event ID 203: Group policy processing for central access policy settings started.

#
Channel
Diagnostic
Opcode
Start

Event ID 204: Failed to create local directory for downloading central access policy settings.

#
Channel
Operational

Description

Failed to create local directory for downloading central access policy settings. Error: ErrorCode.

Message #

Failed to create local directory for downloading central access policy settings. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 205: Processing central access policy settings from the following GPO.

#
Channel
Diagnostic

Message #

Processing central access policy settings from the following GPO.
Display Name: %1
GPO ID: %2
SYSVOL Path: %3

Fields #

NameDescription
GPOName UnicodeString
GPOID UnicodeString
SysvolPath UnicodeString

Event ID 206: Successfully downloaded the central access policy settings file as follows.

#
Channel
Diagnostic

Message #

Successfully downloaded the central access policy settings file as follows.
Remote File: %1
Local File: %2
GPO Name: %3

Fields #

NameDescription
RemoteFile UnicodeString
LocalFile UnicodeString
GPOName UnicodeString

Event ID 207: Failed to downloaded the central access policy settings file as follows.

#
Channel
Operational

Message #

Failed to downloaded the central access policy settings file as follows.
Remote File: %1
Local File: %2
GPO Name: %3
Error: %4

Fields #

NameDescription
RemoteFile UnicodeString
LocalFile UnicodeString
GPOName UnicodeString
ErrorCode UInt32

Event ID 208: Successfully configured the central access policy settings on the system.

#
Channel
Diagnostic

Event ID 209: Failed to configure the central access policy settings on the system.

#
Channel
Operational

Message #

Failed to configure the central access policy settings on the system.
Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 210: Successfully generated RSoP data in WMI.

#
Channel
Diagnostic

Event ID 211: Failed to generate RSoP data in WMI.

#
Channel
Operational

Description

Failed to generate RSoP data in WMI. Error:ErrorCode.

Message #

Failed to generate RSoP data in WMI. Error:%1

Fields #

NameDescription
ErrorCode UInt32

Event ID 212: Group policy processing for central access policy settings finished successfully.

#
Channel
Diagnostic
Opcode
Stop

Event ID 213: Group policy processing for central access policy settings finished with error.

#
Channel
Operational
Opcode
Stop

Description

Group policy processing for central access policy settings finished with error. Error: ErrorCode.

Message #

Group policy processing for central access policy settings finished with error. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Event ID 214: Successfully communicated the results of the operation to group policy engine.

#
Channel
Diagnostic

Event ID 215: Failed to communicate the results of the operation to group policy engine.

#
Channel
Operational

Description

Failed to communicate the results of the operation to group policy engine. Error: ErrorCode.

Message #

Failed to communicate the results of the operation to group policy engine. Error: %1

Fields #

NameDescription
ErrorCode UInt32

Provenance

ETW provider GUID 08466062-aed4-4834-8b04-cddb414504e5

Defined in auditcse.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB