Microsoft-Windows-Security-LessPrivilegedAppContainer
1 events across 1 channel
| Event | Title | Channel | Sample |
|---|---|---|---|
| 1 | Access to the a resource has been denied for a less privileged app container at … | Operational | Y |
Event ID 1: Access to the a resource has been denied for a less privileged app container at FailureTime (StackHash: StackHash).
#Description
Access to the a resource has been denied for a less privileged app container at FailureTime (StackHash: StackHash).
Message #
Fields #
| Name | Description |
|---|---|
FailureTime FILETIME | |
StackHash HexInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Security-LessPrivilegedAppContainer",
"guid": "45EEC9E5-4A1B-5446-7AD8-A4AB1313C437",
"event_source_name": "",
"event_id": 1,
"version": 0,
"level": 2,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-11T06:27:47.906139+00:00",
"event_record_id": 166,
"correlation": {},
"execution": {
"process_id": 6084,
"thread_id": 6236
},
"channel": "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"FailureTime": "2026-03-11T06:27:47.906118Z",
"StackHash": "0xaf5279f2"
},
"message": ""
}
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 45eec9e5-4a1b-5446-7ad8-a4ab1313c437
Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02