Microsoft-Windows-SpecialAdministrationConsole

Event	Title	Channel	Sample	Rule
1	Dispatched command ID Command.	Operational	N	N
2	A new channel has been created.	Operational	N	N
3	A channel has been closed.	Operational	N	N
4	The current channel has been switched.	Operational	N	N
5	The user mode SAC service has registered with the driver.	Operational	N	N
6	The user mode SAC service has unregistered from the driver.	Operational	N	N
7	A new Command Prompt channel could not be launched because launching of Command …	Operational	N	N
8	Prohibited command ID Command was not dispatched.	Operational	N	N

Event ID 1: Dispatched command ID Command.

Dispatched command ID Command. The command line provided was.

Dispatched command ID %1. The command line provided was:

%2

Name	Description
`Command` UInt32
`InputLine` AnsiString

A new channel has been created.

Name: %1
Channel GUID: %2

Name	Description
`Name` UnicodeString
`Guid` GUID

A channel has been closed.

Name: %1
Channel GUID: %2

Name	Description
`Name` UnicodeString
`Guid` GUID

The current channel has been switched.

Name: %1
Description: %2
Type: %3
Channel GUID: %4
Application Type GUID: %5

Prohibited command ID Command was not dispatched. The command line provided was.

Prohibited command ID %1 was not dispatched. The command line provided was:

%2

Name	Description
`Command` UInt32
`InputLine` AnsiString