detection.wiki

Microsoft-Windows-Security-ExchangeActiveSyncProvisioning

EventTitleChannelSampleRule
1Registered EAS supporting Windows Encryption Provider - (DllPath).OperationalNN
2UnRegistered EAS supporting Windows Encryption Provider - (DllPath).OperationalNN
100CheckCompliance beginPerformanceNN
101CheckCompliance end.PerformanceNN

Event ID 1: Registered EAS supporting Windows Encryption Provider - (DllPath).

#
Channel
Operational
Task
EAS_REGPROV

Message #

Registered EAS supporting Windows Encryption Provider - (%1)

Fields #

NameDescription
DllPath UnicodeString

Event ID 2: UnRegistered EAS supporting Windows Encryption Provider - (DllPath).

#
Channel
Operational
Task
EAS_REGPROV

Message #

UnRegistered EAS supporting Windows Encryption Provider - (%1)

Fields #

NameDescription
DllPath UnicodeString

Event ID 100: CheckCompliance begin

#
Channel
Performance
Task
ExchangeActiveSyncProvisioningPerformance
Opcode
Start

Event ID 101: CheckCompliance end.

#
Channel
Performance
Task
ExchangeActiveSyncProvisioningPerformance
Opcode
Stop

Message #

CheckCompliance end:

    elapse: %1 milliseconds

Fields #

NameDescription
TimeSpent UInt32

Provenance

ETW provider GUID 9249d0d0-f034-402f-a29b-92fa8853d9f3

Defined in easwrt.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4163, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.6584, captured 2026-06-02 — Manifest XML pack, 2.0 MB