detection.wiki

Microsoft-Windows-UserAccessLogging

EventTitleChannelSampleRule
0task_0OperationalNN
1task_01OperationalNN

Event ID 0: task_0

#
Channel
Operational

Fields #

NameDescription
RoleGuid GUID
Address UInt32
Username UnicodeString

Event ID 1: task_01

#
Channel
Operational

Fields #

NameDescription
RoleGuid GUID
Address Binary
Username UnicodeString

Provenance

ETW provider GUID 7009de1b-8648-4797-bcf4-cf0b4a7ec148

Defined in ualapi.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB