Windows events and %%something entries

PickleRick — Fri, 01 Oct 2021 12:56:58 GMT

Hi.

I'm using TA for Windows and everything is mostly working OK. But.

In some events I'm receiving values like

If I understand correctly, that's _not_ what evt_resolve_ad_obj option should affect, right? That option affects only resolving (or not) SID-s to usernames/groups and this is something completely different, right?

What is it then? And can I force my UF to forward the same contents that I see in Event Log Viewer?

In this case it's

Read Operation: Enumerate Credentials

I understand that it's something that event log viewer is rendering on its own, because in detail view of the event, it does indeed show %%8100 as ReadOperation so it's apparently the program's intepretation of this data that says "Enumerate Credentials".

So I suppose there'd have to be some lookups to "humanize" the events, right?

topic Windows events and %%something entries in Getting Data In

Windows events and %%something entries