msaudite.dll.mui Security Audit Events DLL 2e0c40a5266e4b96956a88973d01f073

File name:	msaudite.dll.mui
Size:	155136 byte
MD5:	2e0c40a5266e4b96956a88973d01f073
SHA1:	ea17aec21f36db34f5270c9db4614867bda876e9
SHA256:	8568983361007db823b7dc48d9fd4fbc8941db70d345a9d6cee43b36a9f60f60
Operating systems:	Windows 10
Extension:	MUI

If an error occurred or the following message in English (U.S.) language and you cannot find a solution, than check answer in English. Table below helps to know how correctly this phrase sounds in English.

id	English (U.S.)	English
0x0	Unused message ID	Unused message ID
0x1	System Event	System Event
0x2	Logon/Logoff	Logon/Logoff
0x3	Object Access	Object Access
0x4	Privilege Use	Privilege Use
0x5	Detailed Tracking	Detailed Tracking
0x6	Policy Change	Policy Change
0x7	Account Management	Account Management
0x8	Directory Service Access	Directory Service Access
0x9	Account Logon	Account Logon
0x200	Windows is starting up.	Windows is starting up.
0x201	Windows is shutting down.All logon sessions will be terminated by this shutdown.	Windows is shutting down.All logon sessions will be terminated by this shutdown.
0x202	An authentication package has been loaded by the Local Security Authority.This authentication package will be used to authenticate logon attempts.%nAuthentication Package Name:%t%1	An authentication package has been loaded by the Local Security Authority.This authentication package will be used to authenticate logon attempts.%nAuthentication Package Name:%t%1
0x203	A trusted logon process has registered with the Local Security Authority.This logon process will be trusted to submit logon requests.%n%n%tLogon Process Name:%t%1%n%tCaller User Name:%t%2%n%tCaller Domain:%t%3%n%tCaller Logon ID:%t%4%n	A trusted logon process has registered with the Local Security Authority.This logon process will be trusted to submit logon requests.%n%n%tLogon Process Name:%t%1%n%tCaller User Name:%t%2%n%tCaller Domain:%t%3%n%tCaller Logon ID:%t%4%n
0x204	Internal resources allocated for the queuing of audit messages have been exhausted,leading to the loss of some audits.%n%tNumber of audit messages discarded:%t%1	Internal resources allocated for the queuing of audit messages have been exhausted,leading to the loss of some audits.%n%tNumber of audit messages discarded:%t%1
0x205	The audit log was cleared%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tClient Process ID:%t%7%n	The audit log was cleared%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tClient Process ID:%t%7%n
0x206	An notification package has been loaded by the Security Account Manager.This package will be notified of any account or password changes.%nNotification Package Name:%t%1	An notification package has been loaded by the Security Account Manager.This package will be notified of any account or password changes.%nNotification Package Name:%t%1
0x207	Invalid use of LPC port.%n%tProcess ID: %1%n%tImage File Name: %2%n%tPrimary User Name:%t%3%n%tPrimary Domain:%t%4%n%tPrimary Logon ID:%t%5%n%tClient User Name:%t%6%n%tClient Domain:%t%7%n%tClient Logon ID:%t%8%n%tInvalid use: %9%n%tServer Port Name:%t%10%n	Invalid use of LPC port.%n%tProcess ID: %1%n%tImage File Name: %2%n%tPrimary User Name:%t%3%n%tPrimary Domain:%t%4%n%tPrimary Logon ID:%t%5%n%tClient User Name:%t%6%n%tClient Domain:%t%7%n%tClient Logon ID:%t%8%n%tInvalid use: %9%n%tServer Port Name:%t%10%n
0x208	The system time was changed.%nProcess ID:%t%t%1%nProcess Name:%t%t%2%nPrimary User Name:%t%3%nPrimary Domain:%t%t%4%nPrimary Logon ID:%t%t%5%nClient User Name:%t%t%6%nClient Domain:%t%t%7%nClient Logon ID:%t%t%8%nPrevious Time:%t%t%10 %9%nNew Time:%t%t%12 %11%n	The system time was changed.%nProcess ID:%t%t%1%nProcess Name:%t%t%2%nPrimary User Name:%t%3%nPrimary Domain:%t%t%4%nPrimary Logon ID:%t%t%5%nClient User Name:%t%t%6%nClient Domain:%t%t%7%nClient Logon ID:%t%t%8%nPrevious Time:%t%t%10 %9%nNew Time:%t%t%12 %11%n
0x209	Unable to log events to security log:%n%tStatus code:%t%t%1%n%tValue of CrashOnAuditFail:%t%2%n%tNumber of failed audits:%t%3%n	Unable to log events to security log:%n%tStatus code:%t%t%1%n%tValue of CrashOnAuditFail:%t%2%n%tNumber of failed audits:%t%3%n
0x20B	The security log is now %1 percent full.	The security log is now %1 percent full.
0x20C	Event log auto-backup%n%tLog:%t%1%n%tFile:%t%2%n%tStatus:%t%3%n	Event log auto-backup%n%tLog:%t%1%n%tFile:%t%2%n%tStatus:%t%3%n
0x20D	Administrator recovered system from CrashOnAuditFail. LSA will now accept non-administrative logons.Some auditable activity might not have been recorded.%n%tValue of CrashOnAuditFail:%t%1%n	Administrator recovered system from CrashOnAuditFail. LSA will now accept non-administrative logons.Some auditable activity might not have been recorded.%n%tValue of CrashOnAuditFail:%t%1%n
0x20E	A security package has been loaded by the Local Security Authority.%nSecurity Package Name:%t%1	A security package has been loaded by the Local Security Authority.%nSecurity Package Name:%t%1
0x210	Successful Logon:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon Type:%t%4%n%tLogon Process:%t%5%n%tAuthentication Package:%t%6%n%tWorkstation Name:%t%7%n%tLogon GUID:%t%8%n%tCaller User Name:%t%9%n%tCaller Domain:%t%10%n%tCaller Logon ID:%t%11%n%tCaller Process ID: %12%n%tTransited Services: %13%n%tSource Network Address:%t%14%n%tSource Port:%t%15%n%tCaller Process Name:%t%16%n	Successful Logon:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon Type:%t%4%n%tLogon Process:%t%5%n%tAuthentication Package:%t%6%n%tWorkstation Name:%t%7%n%tLogon GUID:%t%8%n%tCaller User Name:%t%9%n%tCaller Domain:%t%10%n%tCaller Logon ID:%t%11%n%tCaller Process ID: %12%n%tTransited Services: %13%n%tSource Network Address:%t%14%n%tSource Port:%t%15%n%tCaller Process Name:%t%16%n
0x211	Logon Failure:%n%tReason:%t%tUnknown user name or bad password%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tUnknown user name or bad password%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x212	Logon Failure:%n%tReason:%t%tAccount logon time restriction violation%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tAccount logon time restriction violation%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x213	Logon Failure:%n%tReason:%t%tAccount currently disabled%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tAccount currently disabled%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x214	Logon Failure:%n%tReason:%t%tThe specified user account has expired%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tThe specified user account has expired%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x215	Logon Failure:%n%tReason:%t%tUser not allowed to logon at this computer%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tUser not allowed to logon at this computer%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x216	Logon Failure:%n%tReason:%tThe user has not been granted the requested%n%t%tlogon type at this machine%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%tThe user has not been granted the requested%n%t%tlogon type at this machine%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x217	Logon Failure:%n%tReason:%t%tThe specified account's password has expired%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tThe specified account's password has expired%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x218	Logon Failure:%n%tReason:%t%tThe NetLogon component is not active%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tThe NetLogon component is not active%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID:%t%10%n%tTransited Services:%t%11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x219	Logon Failure:%n%tReason:%t%tAn error occurred during logon%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tStatus code:%t%7%n%tSubstatus code:%t%8%n%tCaller User Name:%t%9%n%tCaller Domain:%t%10%n%tCaller Logon ID:%t%11%n%tCaller Process ID:%t%12%n%tTransited Services:%t%13%n%tSource Network Address:%t%14%n%tSource Port:%t%15%n%tCaller Process Name:%t%16%n	Logon Failure:%n%tReason:%t%tAn error occurred during logon%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tStatus code:%t%7%n%tSubstatus code:%t%8%n%tCaller User Name:%t%9%n%tCaller Domain:%t%10%n%tCaller Logon ID:%t%11%n%tCaller Process ID:%t%12%n%tTransited Services:%t%13%n%tSource Network Address:%t%14%n%tSource Port:%t%15%n%tCaller Process Name:%t%16%n
0x21A	User Logoff:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon Type:%t%4%n	User Logoff:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon Type:%t%4%n
0x21B	Logon Failure:%n%tReason:%t%tAccount locked out%n%tUser Name:%t%1%n%tDomain:%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID: %10%n%tTransited Services: %11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n	Logon Failure:%n%tReason:%t%tAccount locked out%n%tUser Name:%t%1%n%tDomain:%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID: %10%n%tTransited Services: %11%n%tSource Network Address:%t%12%n%tSource Port:%t%13%n%tCaller Process Name:%t%14%n
0x21C	Successful Network Logon:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon Type:%t%4%n%tLogon Process:%t%5%n%tAuthentication Package:%t%6%n%tWorkstation Name:%t%7%n%tLogon GUID:%t%8%n%tCaller User Name:%t%9%n%tCaller Domain:%t%10%n%tCaller Logon ID:%t%11%n%tCaller Process ID: %12%n%tTransited Services: %13%n%tSource Network Address:%t%14%n%tSource Port:%t%15%n%tCaller Process Name:%t%16%n	Successful Network Logon:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon Type:%t%4%n%tLogon Process:%t%5%n%tAuthentication Package:%t%6%n%tWorkstation Name:%t%7%n%tLogon GUID:%t%8%n%tCaller User Name:%t%9%n%tCaller Domain:%t%10%n%tCaller Logon ID:%t%11%n%tCaller Process ID: %12%n%tTransited Services: %13%n%tSource Network Address:%t%14%n%tSource Port:%t%15%n%tCaller Process Name:%t%16%n
0x21D	IKE security association established.%nMode: %n%1%nPeer Identity: %n%2%nFilter: %n%3%nParameters: %n%4%n	IKE security association established.%nMode: %n%1%nPeer Identity: %n%2%nFilter: %n%3%nParameters: %n%4%n
0x21E	IKE security association ended.%nMode: Data Protection (Quick mode)Filter: %n%1%nInbound SPI: %n%2%nOutbound SPI: %n%3%n	IKE security association ended.%nMode: Data Protection (Quick mode)Filter: %n%1%nInbound SPI: %n%2%nOutbound SPI: %n%3%n
0x21F	IKE security association ended.%nMode: Key Exchange (Main mode)%nFilter: %n%1%n	IKE security association ended.%nMode: Key Exchange (Main mode)%nFilter: %n%1%n
0x220	IKE security association establishment failed because peer could not authenticate.The certificate trust could not be established.%nPeer Identity: %n%1%nFilter: %n%2%n	IKE security association establishment failed because peer could not authenticate.The certificate trust could not be established.%nPeer Identity: %n%1%nFilter: %n%2%n
0x221	IKE peer authentication failed.%nPeer Identity: %n%1%nFilter: %n%2%n	IKE peer authentication failed.%nPeer Identity: %n%1%nFilter: %n%2%n
0x222	IKE security association establishment failed because peersent invalid proposal.%nMode: %n%1%nFilter: %n%2%nAttribute: %n%3%nExpected value: %n%4%nReceived value: %n%5%n	IKE security association establishment failed because peersent invalid proposal.%nMode: %n%1%nFilter: %n%2%nAttribute: %n%3%nExpected value: %n%4%nReceived value: %n%5%n
0x223	IKE security association negotiation failed.%nMode: %n%1%nFilter: %n%2%nPeer Identity: %n%3%nFailure Point: %n%4%nFailure Reason: %n%5%nExtra Status: %n%6%n	IKE security association negotiation failed.%nMode: %n%1%nFilter: %n%2%nPeer Identity: %n%3%nFailure Point: %n%4%nFailure Reason: %n%5%nExtra Status: %n%6%n
0x224	Logon Failure:%n%tReason:%t%tDomain sid inconsistent%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%tTransited Services:%t%7%n	Logon Failure:%n%tReason:%t%tDomain sid inconsistent%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%tTransited Services:%t%7%n
0x225	Logon Failure:%n%tReason: %tAll sids were filtered out%n%tUser Name:%t%1%n%tDomain:%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package%t: %5%n%tWorkstation Name:%t%6	Logon Failure:%n%tReason: %tAll sids were filtered out%n%tUser Name:%t%1%n%tDomain:%t%2%n%tLogon Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package%t: %5%n%tWorkstation Name:%t%6
0x226	%1%n	%1%n
0x227	User initiated logoff:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n	User initiated logoff:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n
0x228	Logon attempt using explicit credentials:%nLogged on user:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon GUID:%t%4%nUser whose credentials were used:%n%tTarget User Name:%t%5%n%tTarget Domain:%t%6%n%tTarget Logon GUID: %7%n%nTarget Server Name:%t%8%nTarget Server Info:%t%9%nCaller Process ID:%t%10%nSource Network Address:%t%11%nSource Port:%t%12%nCaller Process Name:%t%13%n	Logon attempt using explicit credentials:%nLogged on user:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tLogon GUID:%t%4%nUser whose credentials were used:%n%tTarget User Name:%t%5%n%tTarget Domain:%t%6%n%tTarget Logon GUID: %7%n%nTarget Server Name:%t%8%nTarget Server Info:%t%9%nCaller Process ID:%t%10%nSource Network Address:%t%11%nSource Port:%t%12%nCaller Process Name:%t%13%n
0x229	%tUser Name:%t%1%n%tDomain:%t%%t%2%n%tRequest Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID: %10%n%tTransited Services: %11%n%tCaller Process Name:%t%12%n	%tUser Name:%t%1%n%tDomain:%t%%t%2%n%tRequest Type:%t%3%n%tLogon Process:%t%4%n%tAuthentication Package:%t%5%n%tWorkstation Name:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Process ID: %10%n%tTransited Services: %11%n%tCaller Process Name:%t%12%n
0x22A	IPSec main mode security association established. User mode is not configured.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode my Id: %8%nMain mode peer Id: %9%nCipher algorithm: %10%nIntegrity algorithm: %11%nLifetime (seconds): %12%nMain mode impersonation: %13%nMain mode SA LUID: %14%n	IPSec main mode security association established. User mode is not configured.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode my Id: %8%nMain mode peer Id: %9%nCipher algorithm: %10%nIntegrity algorithm: %11%nLifetime (seconds): %12%nMain mode impersonation: %13%nMain mode SA LUID: %14%n
0x22B	IPSec main mode security association established. User mode is not configured.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode peer subject: %n%8%nMain mode peer issuing certificate authority: %n%9%nMain mode peer root certificate authority: %n%10%nMain mode peer SHA thumbprint: %n%11%nMain mode my subject: %n%12%nMain mode my SHA thumbprint: %n%13%nCipher algorithm: %14%nIntegrity algorithm: %15%nLifetime (seconds): %16%nMain mode impersonation: %17%nMain mode SA LUID: %18%n	IPSec main mode security association established. User mode is not configured.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode peer subject: %n%8%nMain mode peer issuing certificate authority: %n%9%nMain mode peer root certificate authority: %n%10%nMain mode peer SHA thumbprint: %n%11%nMain mode my subject: %n%12%nMain mode my SHA thumbprint: %n%13%nCipher algorithm: %14%nIntegrity algorithm: %15%nLifetime (seconds): %16%nMain mode impersonation: %17%nMain mode SA LUID: %18%n
0x22C	IPSec main mode security association establishment failed.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode peer subject: %n%8%nMain mode peer issuing certificate authority: %n%9%nMain mode peer root certificate authority: %n%10%nMain mode peer SHA thumbprint: %n%11%nMain mode my subject: %n%12%nMain mode my SHA thumbprint: %n%13%nFailure point: %14%nFailure reason: %15%nMain mode IKE state: %16%nInitiator or Responder: %17%nMain mode impersonation: %18%n	IPSec main mode security association establishment failed.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode peer subject: %n%8%nMain mode peer issuing certificate authority: %n%9%nMain mode peer root certificate authority: %n%10%nMain mode peer SHA thumbprint: %n%11%nMain mode my subject: %n%12%nMain mode my SHA thumbprint: %n%13%nFailure point: %14%nFailure reason: %15%nMain mode IKE state: %16%nInitiator or Responder: %17%nMain mode impersonation: %18%n
0x22D	IPSec main mode security association establishment failed.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode my Id: %8%nMain mode peer Id: %9%nFailure point: %10%nFailure reason: %11%nMain mode IKE state: %12%nInitiator or Responder: %13%nMain mode impersonation: %14%n	IPSec main mode security association establishment failed.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode authentication method: %7%nMain mode my Id: %8%nMain mode peer Id: %9%nFailure point: %10%nFailure reason: %11%nMain mode IKE state: %12%nInitiator or Responder: %13%nMain mode impersonation: %14%n
0x22E	IPSec quick mode security association establishment failed.%nKeying module type: %1%nLocal address: %2%nLocal address mask: %3%nRemote address: %4%nRemote address mask: %5%nLocal port: %6%nRemote port: %7%nProtocol: %8%nEncapsulation type: %9%nFailure point: %10%nFailure reason: %11%nQuick mode IKE state: %12%nInitiator or Responder: %13%nMain mode SA LUID: %14%n	IPSec quick mode security association establishment failed.%nKeying module type: %1%nLocal address: %2%nLocal address mask: %3%nRemote address: %4%nRemote address mask: %5%nLocal port: %6%nRemote port: %7%nProtocol: %8%nEncapsulation type: %9%nFailure point: %10%nFailure reason: %11%nQuick mode IKE state: %12%nInitiator or Responder: %13%nMain mode SA LUID: %14%n
0x22F	IPSec main mode security association ended.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode SA LUID: %7%n	IPSec main mode security association ended.%nKeying module type: %1%nLocal address: %2%nRemote address: %3%nLocal port: %4%nRemote port: %5%nPeer private address: %6%nMain mode SA LUID: %7%n
0x230	Object Open:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tOperation ID:%t%5%n%tProcess ID:%t%6%n%tImage File Name:%t%7%n%tPrimary User Name:%t%8%n%tPrimary Domain:%t%9%n%tPrimary Logon ID:%t%10%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n%tAccesses:%t%14%n%tPrivileges:%t%15%n%tRestricted Sid Count:%t%16%n%tAccess Mask:%t%17%n	Object Open:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tOperation ID:%t%5%n%tProcess ID:%t%6%n%tImage File Name:%t%7%n%tPrimary User Name:%t%8%n%tPrimary Domain:%t%9%n%tPrimary Logon ID:%t%10%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n%tAccesses:%t%14%n%tPrivileges:%t%15%n%tRestricted Sid Count:%t%16%n%tAccess Mask:%t%17%n
0x232	Handle Closed:%n%tObject Server:%t%1%n%tHandle ID:%t%2%n%tProcess ID:%t%3%n%tImage File Name:%t%4%n	Handle Closed:%n%tObject Server:%t%1%n%tHandle ID:%t%2%n%tProcess ID:%t%3%n%tImage File Name:%t%4%n
0x233	Object Open for Delete:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tOperation ID:%t{%5,%6}%n%tProcess ID:%t%7%n%tPrimary User Name:%t%8%n%tPrimary Domain:%t%9%n%tPrimary Logon ID:%t%10%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n%tAccesses:%t%t%14%n%tPrivileges:%t%t%15%n%tAccess Mask:%t%16%n	Object Open for Delete:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tOperation ID:%t{%5,%6}%n%tProcess ID:%t%7%n%tPrimary User Name:%t%8%n%tPrimary Domain:%t%9%n%tPrimary Logon ID:%t%10%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n%tAccesses:%t%t%14%n%tPrivileges:%t%t%15%n%tAccess Mask:%t%16%n
0x234	Object Deleted:%n%tObject Server:%t%1%n%tHandle ID:%t%2%n%tProcess ID:%t%3%n%tImage File Name:%t%4%n	Object Deleted:%n%tObject Server:%t%1%n%tHandle ID:%t%2%n%tProcess ID:%t%3%n%tImage File Name:%t%4%n
0x235	Object Open:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tOperation ID:%t{%5,%6}%n%tProcess ID:%t%7%n%tProcess Name:%t%8%n%tPrimary User Name:%t%9%n%tPrimary Domain:%t%10%n%tPrimary Logon ID:%t%11%n%tClient User Name:%t%12%n%tClient Domain:%t%13%n%tClient Logon ID:%t%14%n%tAccesses:%t%15%n%tPrivileges:%t%16%n%n%tProperties:%n%17%n%tAccess Mask:%t%18%n	Object Open:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tOperation ID:%t{%5,%6}%n%tProcess ID:%t%7%n%tProcess Name:%t%8%n%tPrimary User Name:%t%9%n%tPrimary Domain:%t%10%n%tPrimary Logon ID:%t%11%n%tClient User Name:%t%12%n%tClient Domain:%t%13%n%tClient Logon ID:%t%14%n%tAccesses:%t%15%n%tPrivileges:%t%16%n%n%tProperties:%n%17%n%tAccess Mask:%t%18%n
0x236	Object Operation:%n%tObject Server:%t%1%n%tOperation Type:%t%2%n%tObject Type:%t%3%n%tObject Name:%t%4%n%tHandle ID:%t%5%n%tPrimary User Name:%t%6%n%tPrimary Domain:%t%7%n%tPrimary Logon ID:%t%8%n%tClient User Name:%t%9%n%tClient Domain:%t%10%n%tClient Logon ID:%t%11%n%tAccesses:%t%12%n%tProperties:%n%t%13%n%tAdditional Info:%t%14%n%tAdditional Info2:%t%15%n%tAccess Mask:%t%16%n	Object Operation:%n%tObject Server:%t%1%n%tOperation Type:%t%2%n%tObject Type:%t%3%n%tObject Name:%t%4%n%tHandle ID:%t%5%n%tPrimary User Name:%t%6%n%tPrimary Domain:%t%7%n%tPrimary Logon ID:%t%8%n%tClient User Name:%t%9%n%tClient Domain:%t%10%n%tClient Logon ID:%t%11%n%tAccesses:%t%12%n%tProperties:%n%t%13%n%tAdditional Info:%t%14%n%tAdditional Info2:%t%15%n%tAccess Mask:%t%16%n
0x237	Object Access Attempt:%n%tObject Server:%t%1%n%tHandle ID:%t%2%n%tObject Type:%t%3%n%tProcess ID:%t%4%n%tImage File Name:%t%5%n%tAccesses:%t%6%n%tAccess Mask:%t%7%n%tObject Name:%t%8%n%tPrimary User Name:%t%9%n%tPrimary Domain:%t%10%n%tPrimary Logon ID:%t%11%n%tClient User Name:%t%12%n%tClient Domain:%t%13%n%tClient Logon ID:%t%14%n	Object Access Attempt:%n%tObject Server:%t%1%n%tHandle ID:%t%2%n%tObject Type:%t%3%n%tProcess ID:%t%4%n%tImage File Name:%t%5%n%tAccesses:%t%6%n%tAccess Mask:%t%7%n%tObject Name:%t%8%n%tPrimary User Name:%t%9%n%tPrimary Domain:%t%10%n%tPrimary Logon ID:%t%11%n%tClient User Name:%t%12%n%tClient Domain:%t%13%n%tClient Logon ID:%t%14%n
0x238	Hard link creation attempt:%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tFile Name:%t%4%n%tLink Name:%t%5%n	Hard link creation attempt:%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tFile Name:%t%4%n%tLink Name:%t%5%n
0x239	Application client context creation attempt:%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tClient Name:%t%3%n%tClient Domain:%t%4%n%tClient Context ID:%t%5%n%tStatus:%t%6%n	Application client context creation attempt:%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tClient Name:%t%3%n%tClient Domain:%t%4%n%tClient Context ID:%t%5%n%tStatus:%t%6%n
0x23A	Application operation attempt:%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tObject Name:%t%3%n%tScope Names:%t%4%n%tClient Name:%t%5%n%tClient Domain:%t%6%n%tClient Context ID:%t%7%n%tRole:%t%8%n%tGroups:%t%9%n%tOperation Name:%t%10 (%11)%n	Application operation attempt:%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tObject Name:%t%3%n%tScope Names:%t%4%n%tClient Name:%t%5%n%tClient Domain:%t%6%n%tClient Context ID:%t%7%n%tRole:%t%8%n%tGroups:%t%9%n%tOperation Name:%t%10 (%11)%n
0x23B	Application client context deletion:%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tClient Name:%t%3%n%tClient Domain:%t%4%n%tClient Context ID:%t%5%n	Application client context deletion:%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tClient Name:%t%3%n%tClient Domain:%t%4%n%tClient Context ID:%t%5%n
0x23C	Application Initialized%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tClient Name:%t%3%n%tClient Domain:%t%4%n%tClient ID:%t%5%n%tPolicy Store URL:%t%6%n	Application Initialized%n%tApplication Name:%t%1%n%tApplication Instance ID:%t%2%n%tClient Name:%t%3%n%tClient Domain:%t%4%n%tClient ID:%t%5%n%tPolicy Store URL:%t%6%n
0x23D	%nApplication-specific security event.%n%tEvent Source:%t%1%n%tEvent ID:%t%2%n%t%t%3%n%t%t%4%n%t%t%5%n%t%t%6%n%t%t%7%n%t%t%8%n%t%t%9%n%t%t%10%n%t%t%11%n%t%t%12%n%t%t%13%n%t%t%14%n%t%t%15%n%t%t%16%n%t%t%17%n%t%t%18%n%t%t%19%n%t%t%20%n%t%t%21%n%t%t%22%n%t%t%23%n%t%t%24%n%t%t%25%n%t%t%26%n%t%t%27%n	%nApplication-specific security event.%n%tEvent Source:%t%1%n%tEvent ID:%t%2%n%t%t%3%n%t%t%4%n%t%t%5%n%t%t%6%n%t%t%7%n%t%t%8%n%t%t%9%n%t%t%10%n%t%t%11%n%t%t%12%n%t%t%13%n%t%t%14%n%t%t%15%n%t%t%16%n%t%t%17%n%t%t%18%n%t%t%19%n%t%t%20%n%t%t%21%n%t%t%22%n%t%t%23%n%t%t%24%n%t%t%25%n%t%t%26%n%t%t%27%n
0x23E	Security on object changed:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tProcess ID:%t%5%n%tImage File Name:%t%6%n%n%tPrimary User Name:%t%7%n%tPrimary Domain:%t%8%n%tPrimary Logon ID:%t%9%n%tClient User Name:%t%10%n%tClient Domain:%t%11%n%tClient Logon ID:%t%12%n%tOriginal Security Descriptor:%t%13%n%tNew Security Descriptor:%t%14%n	Security on object changed:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tProcess ID:%t%5%n%tImage File Name:%t%6%n%n%tPrimary User Name:%t%7%n%tPrimary Domain:%t%8%n%tPrimary Logon ID:%t%9%n%tClient User Name:%t%10%n%tClient Domain:%t%11%n%tClient Logon ID:%t%12%n%tOriginal Security Descriptor:%t%13%n%tNew Security Descriptor:%t%14%n
0x240	Special privileges assigned to new logon:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tPrivileges:%t%4	Special privileges assigned to new logon:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tPrivileges:%t%4
0x241	Privileged Service Called:%n%tServer:%t%t%1%n%tService:%t%t%2%n%tPrimary User Name:%t%3%n%tPrimary Domain:%t%4%n%tPrimary Logon ID:%t%5%n%tClient User Name:%t%6%n%tClient Domain:%t%7%n%tClient Logon ID:%t%8%n%tPrivileges:%t%9%n%tProcess ID:%t%10%n%tProcess Name:%t%11	Privileged Service Called:%n%tServer:%t%t%1%n%tService:%t%t%2%n%tPrimary User Name:%t%3%n%tPrimary Domain:%t%4%n%tPrimary Logon ID:%t%5%n%tClient User Name:%t%6%n%tClient Domain:%t%7%n%tClient Logon ID:%t%8%n%tPrivileges:%t%9%n%tProcess ID:%t%10%n%tProcess Name:%t%11
0x242	Privileged object operation:%n%tObject Server:%t%1%n%tObject Handle:%t%2%n%tProcess ID:%t%3%n%tPrimary User Name:%t%4%n%tPrimary Domain:%t%5%n%tPrimary Logon ID:%t%6%n%tClient User Name:%t%7%n%tClient Domain:%t%8%n%tClient Logon ID:%t%9%n%tPrivileges:%t%10%n%tObject Type:%t%11%n%tObject Name:%t%12%n%tDesired Access:%t%13	Privileged object operation:%n%tObject Server:%t%1%n%tObject Handle:%t%2%n%tProcess ID:%t%3%n%tPrimary User Name:%t%4%n%tPrimary Domain:%t%5%n%tPrimary Logon ID:%t%6%n%tClient User Name:%t%7%n%tClient Domain:%t%8%n%tClient Logon ID:%t%9%n%tPrivileges:%t%10%n%tObject Type:%t%11%n%tObject Name:%t%12%n%tDesired Access:%t%13
0x250	A new process has been created:%n%tNew Process ID:%t%1%n%tImage File Name:%t%2%n%tCreator Process ID:%t%3%n%tUser Name:%t%4%n%tDomain:%t%t%5%n%tLogon ID:%t%t%6%n%tToken Elevation Type:%t%7%n	A new process has been created:%n%tNew Process ID:%t%1%n%tImage File Name:%t%2%n%tCreator Process ID:%t%3%n%tUser Name:%t%4%n%tDomain:%t%t%5%n%tLogon ID:%t%t%6%n%tToken Elevation Type:%t%7%n
0x251	A process has exited:%n%tProcess ID:%t%1%n%tImage File Name:%t%2%n%tUser Name:%t%3%n%tDomain:%t%t%4%n%tLogon ID:%t%t%5%n%tExit Status:%t%t%6%n	A process has exited:%n%tProcess ID:%t%1%n%tImage File Name:%t%2%n%tUser Name:%t%3%n%tDomain:%t%t%4%n%tLogon ID:%t%t%5%n%tExit Status:%t%t%6%n
0x252	A handle to an object has been duplicated:%n%tSource Handle ID:%t%1%n%tSource Process ID:%t%2%n%tTarget Handle ID:%t%3%n%tTarget Process ID:%t%4%n	A handle to an object has been duplicated:%n%tSource Handle ID:%t%1%n%tSource Process ID:%t%2%n%tTarget Handle ID:%t%3%n%tTarget Process ID:%t%4%n
0x253	Indirect access to an object has been obtained:%n%tObject Type:%t%1%n%tObject Name:%t%2%n%tProcess ID:%t%3%n%tPrimary User Name:%t%4%n%tPrimary Domain:%t%5%n%tPrimary Logon ID:%t%6%n%tClient User Name:%t%7%n%tClient Domain:%t%8%n%tClient Logon ID:%t%9%n%tAccesses:%t%10%n%tAccess Mask:%t%11%n	Indirect access to an object has been obtained:%n%tObject Type:%t%1%n%tObject Name:%t%2%n%tProcess ID:%t%3%n%tPrimary User Name:%t%4%n%tPrimary Domain:%t%5%n%tPrimary Logon ID:%t%6%n%tClient User Name:%t%7%n%tClient Domain:%t%8%n%tClient Logon ID:%t%9%n%tAccesses:%t%10%n%tAccess Mask:%t%11%n
0x254	Backup of data protection master key.%n%tKey Identifier:%t%t%1%n%tRecovery Server:%t%t%2%n%tRecovery Key ID:%t%t%3%n%tFailure Reason:%t%t%4%nBy:%n%t User Name:%t%5%n%t Domain Name:%t%6%n%t Logon ID:%t%7	Backup of data protection master key.%n%tKey Identifier:%t%t%1%n%tRecovery Server:%t%t%2%n%tRecovery Key ID:%t%t%3%n%tFailure Reason:%t%t%4%nBy:%n%t User Name:%t%5%n%t Domain Name:%t%6%n%t Logon ID:%t%7
0x255	Recovery of data protection master key.%n%tKey Identifier:%t%t%1%n%tRecovery Reason:%t%t%3%n%tRecovery Server:%t%t%2%n%tRecovery Key ID:%t%t%4%n%tFailure Reason:%t%t%5%nBy:%n%t User Name:%t%6%n%t Domain Name:%t%7%n%t Logon ID:%t%8	Recovery of data protection master key.%n%tKey Identifier:%t%t%1%n%tRecovery Reason:%t%t%3%n%tRecovery Server:%t%t%2%n%tRecovery Key ID:%t%t%4%n%tFailure Reason:%t%t%5%nBy:%n%t User Name:%t%6%n%t Domain Name:%t%7%n%t Logon ID:%t%8
0x256	Protection of auditable protected data.%n%tData Description:%t%t%2%n%tKey Identifier:%t%t%1%n%tProtected Data Flags:%t%3%n%tProtection Algorithms:%t%4%n%tFailure Reason:%t%t%5%nBy:%n%t User Name:%t%6%n%t Domain Name:%t%7%n%t Logon ID:%t%8	Protection of auditable protected data.%n%tData Description:%t%t%2%n%tKey Identifier:%t%t%1%n%tProtected Data Flags:%t%3%n%tProtection Algorithms:%t%4%n%tFailure Reason:%t%t%5%nBy:%n%t User Name:%t%6%n%t Domain Name:%t%7%n%t Logon ID:%t%8
0x257	Unprotection of auditable protected data.%n%tData Description:%t%t%2%n%tKey Identifier:%t%t%1%n%tProtected Data Flags:%t%3%n%tProtection Algorithms:%t%4%n%tFailure Reason:%t%t%5%nBy:%n%t User Name:%t%6%n%t Domain Name:%t%7%n%t Logon ID:%t%8	Unprotection of auditable protected data.%n%tData Description:%t%t%2%n%tKey Identifier:%t%t%1%n%tProtected Data Flags:%t%3%n%tProtection Algorithms:%t%4%n%tFailure Reason:%t%t%5%nBy:%n%t User Name:%t%6%n%t Domain Name:%t%7%n%t Logon ID:%t%8
0x258	A process was assigned a primary token.%nAssigning Process Information:%n%tProcess ID:%t%1%n%tImage File Name:%t%2%n%tPrimary User Name:%t%3%n%tPrimary Domain:%t%4%n%tPrimary Logon ID:%t%5%nNew Process Information:%n%tProcess ID:%t%6%n%tImage File Name:%t%7%n%tTarget User Name:%t%8%n%tTarget Domain:%t%9%n%tTarget Logon ID:%t%10%n	A process was assigned a primary token.%nAssigning Process Information:%n%tProcess ID:%t%1%n%tImage File Name:%t%2%n%tPrimary User Name:%t%3%n%tPrimary Domain:%t%4%n%tPrimary Logon ID:%t%5%nNew Process Information:%n%tProcess ID:%t%6%n%tImage File Name:%t%7%n%tTarget User Name:%t%8%n%tTarget Domain:%t%9%n%tTarget Logon ID:%t%10%n
0x259	Attempt to install service:%n%tService Name:%t%1%n%tService File Name:%t%2%n%tService Type:%t%3%n%tService Start Type:%t%4%n%tService Account:%t%5%nBy:%n%tUser Name:%t%6%n%tDomain:%t%t%7%n%tLogon ID:%t%t%8%n	Attempt to install service:%n%tService Name:%t%1%n%tService File Name:%t%2%n%tService Type:%t%3%n%tService Start Type:%t%4%n%tService Account:%t%5%nBy:%n%tUser Name:%t%6%n%tDomain:%t%t%7%n%tLogon ID:%t%t%8%n
0x25A	Scheduled Task created:%n%tFile Name:%t%1%n%tCommand:%t%2%n%tTriggers:%t%t%3%n%tTime:%t%t%4 %5%n%tFlags:%t%t%6%n%tTarget User:%t%7%nBy:%n%tUser:%t%t%8%n%tDomain:%t%t%9%n%tLogon ID:%t%t%10%n	Scheduled Task created:%n%tFile Name:%t%1%n%tCommand:%t%2%n%tTriggers:%t%t%3%n%tTime:%t%t%4 %5%n%tFlags:%t%t%6%n%tTarget User:%t%7%nBy:%n%tUser:%t%t%8%n%tDomain:%t%t%9%n%tLogon ID:%t%t%10%n
0x260	User Right Assigned:%n%tUser Right:%t%1%n%tAssigned To:%t%2%n%tAssigned By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n	User Right Assigned:%n%tUser Right:%t%1%n%tAssigned To:%t%2%n%tAssigned By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n
0x261	User Right Removed:%n%tUser Right:%t%1%n%tRemoved From:%t%2%n%tRemoved By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n	User Right Removed:%n%tUser Right:%t%1%n%tRemoved From:%t%2%n%tRemoved By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n
0x262	New Trusted Domain:%n%tDomain Name:%t%1%n%tDomain ID:%t%2%n%tEstablished By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n%tTrust Type:%t%6%n%tTrust Direction:%t%7%n%tTrust Attributes:%t%8%n%tSID Filtering:%t%9%n	New Trusted Domain:%n%tDomain Name:%t%1%n%tDomain ID:%t%2%n%tEstablished By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n%tTrust Type:%t%6%n%tTrust Direction:%t%7%n%tTrust Attributes:%t%8%n%tSID Filtering:%t%9%n
0x263	Trusted Domain Removed:%n%tDomain Name:%t%1%n%tDomain ID:%t%2%n%tRemoved By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n	Trusted Domain Removed:%n%tDomain Name:%t%1%n%tDomain ID:%t%2%n%tRemoved By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n
0x264	Audit Policy Change:%nNew Policy:%n%tSuccess%tFailure%n%t %3%t %4%tLogon/Logoff%n%t %5%t %6%tObject Access%n%t %7%t %8%tPrivilege Use%n%t %13%t %14%tAccount Management%n%t %11%t %12%tPolicy Change%n%t %1%t %2%tSystem%n%t %9%t %10%tDetailed Tracking%n%t %15%t %16%tDirectory Service Access%n%t %17%t %18%tAccount Logon%n%nChanged By:%n%t User Name:%t%19%n%t Domain Name:%t%20%n%t Logon ID:%t%21	Audit Policy Change:%nNew Policy:%n%tSuccess%tFailure%n%t %3%t %4%tLogon/Logoff%n%t %5%t %6%tObject Access%n%t %7%t %8%tPrivilege Use%n%t %13%t %14%tAccount Management%n%t %11%t %12%tPolicy Change%n%t %1%t %2%tSystem%n%t %9%t %10%tDetailed Tracking%n%t %15%t %16%tDirectory Service Access%n%t %17%t %18%tAccount Logon%n%nChanged By:%n%t User Name:%t%19%n%t Domain Name:%t%20%n%t Logon ID:%t%21
0x265	IPSec Services started: %t%1%nPolicy Source: %t%2%n%3%n	IPSec Services started: %t%1%nPolicy Source: %t%2%n%3%n
0x266	IPSec Services disabled: %t%1%n%2%n	IPSec Services disabled: %t%1%n%2%n
0x267	%1	%1
0x268	IPSec Services encountered a potentially serious failure.%n%1%n	IPSec Services encountered a potentially serious failure.%n%1%n
0x269	Kerberos Policy Changed:%nChanged By:%n%t User Name:%t%1%n%t Domain Name:%t%2%n%t Logon ID:%t%3%nChanges made:%n('--' means no changes, otherwise each change is shown as:%n: ())%n%4%n	Kerberos Policy Changed:%nChanged By:%n%t User Name:%t%1%n%t Domain Name:%t%2%n%t Logon ID:%t%3%nChanges made:%n('--' means no changes, otherwise each change is shown as:%n: ())%n%4%n
0x26A	Encrypted Data Recovery Policy Changed:%nChanged By:%n%t User Name:%t%1%n%t Domain Name:%t%2%n%t Logon ID:%t%3%nChanges made:%n('--' means no changes, otherwise each change is shown as:%n: ())%n%4%n	Encrypted Data Recovery Policy Changed:%nChanged By:%n%t User Name:%t%1%n%t Domain Name:%t%2%n%t Logon ID:%t%3%nChanges made:%n('--' means no changes, otherwise each change is shown as:%n: ())%n%4%n
0x26B	Audit Security Object changed:%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tOriginal Security Descriptor:%t%7%n%tNew Security Descriptor:%t%8%n	Audit Security Object changed:%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tOriginal Security Descriptor:%t%7%n%tNew Security Descriptor:%t%8%n
0x26C	Trusted Domain Information Modified:%n%tDomain Name:%t%1%n%tDomain ID:%t%2%n%tModified By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n%tTrust Type:%t%6%n%tTrust Direction:%t%7%n%tTrust Attributes:%t%8%n%tSID Filtering:%t%9%n	Trusted Domain Information Modified:%n%tDomain Name:%t%1%n%tDomain ID:%t%2%n%tModified By:%n%t User Name:%t%3%n%t Domain:%t%t%4%n%t Logon ID:%t%5%n%tTrust Type:%t%6%n%tTrust Direction:%t%7%n%tTrust Attributes:%t%8%n%tSID Filtering:%t%9%n
0x26D	System Security Access Granted:%n%tAccess Granted:%t%4%n%tAccount Modified:%t%5%n%tAssigned By:%n%t User Name:%t%1%n%t Domain:%t%t%2%n%t Logon ID:%t%3%n	System Security Access Granted:%n%tAccess Granted:%t%4%n%tAccount Modified:%t%5%n%tAssigned By:%n%t User Name:%t%1%n%t Domain:%t%t%2%n%t Logon ID:%t%3%n
0x26E	System Security Access Removed:%n%tAccess Removed:%t%4%n%tAccount Modified:%t%5%n%tRemoved By:%n%t User Name:%t%1%n%t Domain:%t%t%2%n%t Logon ID:%t%3%n	System Security Access Removed:%n%tAccess Removed:%t%4%n%tAccount Modified:%t%5%n%tRemoved By:%n%t User Name:%t%1%n%t Domain:%t%t%2%n%t Logon ID:%t%3%n
0x26F	System Audit Policy Change:%n Category:%t%1%n Sub Category:%t%2%n Sub Category Guid:%t%3%n Changes:%t%4%n%nChanged By:%n User Name:%t%5%n Domain Name:%t%6%n Logon ID:%t%7	System Audit Policy Change:%n Category:%t%1%n Sub Category:%t%2%n Sub Category Guid:%t%3%n Changes:%t%4%n%nChanged By:%n User Name:%t%5%n Domain Name:%t%6%n Logon ID:%t%7
0x270	User Account Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges%t%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tDisplay Name:%t%9%n%tUser Principal Name:%t%10%n%tHome Directory:%t%11%n%tHome Drive:%t%12%n%tScript Path:%t%13%n%tProfile Path:%t%14%n%tUser Workstations:%t%15%n%tPassword Last Set:%t%16%n%tAccount Expires:%t%17%n%tPrimary Group ID:%t%18%n%tAllowedToDelegateTo:%t%19%n%tOld UAC Value:%t%20%n%tNew UAC Value:%t%21%n%tUser Account Control:%t%22%n%tUser Parameters:%t%23%n%tSid History:%t%24%n%tLogon Hours:%t%25%n	User Account Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges%t%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tDisplay Name:%t%9%n%tUser Principal Name:%t%10%n%tHome Directory:%t%11%n%tHome Drive:%t%12%n%tScript Path:%t%13%n%tProfile Path:%t%14%n%tUser Workstations:%t%15%n%tPassword Last Set:%t%16%n%tAccount Expires:%t%17%n%tPrimary Group ID:%t%18%n%tAllowedToDelegateTo:%t%19%n%tOld UAC Value:%t%20%n%tNew UAC Value:%t%21%n%tUser Account Control:%t%22%n%tUser Parameters:%t%23%n%tSid History:%t%24%n%tLogon Hours:%t%25%n
0x272	User Account Enabled:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n	User Account Enabled:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n
0x273	Change Password Attempt:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Change Password Attempt:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x274	User Account password set:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n	User Account password set:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n
0x275	User Account Disabled:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n	User Account Disabled:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n
0x276	User Account Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	User Account Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x277	Security Enabled Global Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Enabled Global Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x278	Security Enabled Global Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Enabled Global Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x279	Security Enabled Global Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Enabled Global Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x27A	Security Enabled Global Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Security Enabled Global Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x27B	Security Enabled Local Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Enabled Local Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x27C	Security Enabled Local Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Enabled Local Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x27D	Security Enabled Local Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Enabled Local Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x27E	Security Enabled Local Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Security Enabled Local Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x27F	Security Enabled Local Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Enabled Local Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x280	General Account Database Change:%n%tType of change:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tObject ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n	General Account Database Change:%n%tType of change:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tObject ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n
0x281	Security Enabled Global Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Enabled Global Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x282	User Account Changed:%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%nChanged Attributes:%n%tSam Account Name:%t%9%n%tDisplay Name:%t%10%n%tUser Principal Name:%t%11%n%tHome Directory:%t%12%n%tHome Drive:%t%13%n%tScript Path:%t%14%n%tProfile Path:%t%15%n%tUser Workstations:%t%16%n%tPassword Last Set:%t%17%n%tAccount Expires:%t%18%n%tPrimary Group ID:%t%19%n%tAllowedToDelegateTo:%t%20%n%tOld UAC Value:%t%21%n%tNew UAC Value:%t%22%n%tUser Account Control:%t%23%n%tUser Parameters:%t%24%n%tSid History:%t%25%n%tLogon Hours:%t%26%n	User Account Changed:%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%nChanged Attributes:%n%tSam Account Name:%t%9%n%tDisplay Name:%t%10%n%tUser Principal Name:%t%11%n%tHome Directory:%t%12%n%tHome Drive:%t%13%n%tScript Path:%t%14%n%tProfile Path:%t%15%n%tUser Workstations:%t%16%n%tPassword Last Set:%t%17%n%tAccount Expires:%t%18%n%tPrimary Group ID:%t%19%n%tAllowedToDelegateTo:%t%20%n%tOld UAC Value:%t%21%n%tNew UAC Value:%t%22%n%tUser Account Control:%t%23%n%tUser Parameters:%t%24%n%tSid History:%t%25%n%tLogon Hours:%t%26%n
0x283	Domain Policy Changed: %1 modified%n%tDomain Name:%t%t%2%n%tDomain ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tMin. Password Age:%t%8%n%tMax. Password Age:%t%9%n%tForce Logoff:%t%10%n%tLockout Threshold:%t%11%n%tLockout Observation Window:%t%12%n%tLockout Duration:%t%13%n%tPassword Properties:%t%14%n%tMin. Password Length:%t%15%n%tPassword History Length:%t%16%n%tMachine Account Quota:%t%17%n%tMixed Domain Mode:%t%18%n%tDomain Behavior Version:%t%19%n%tOEM Information:%t%20%n	Domain Policy Changed: %1 modified%n%tDomain Name:%t%t%2%n%tDomain ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tMin. Password Age:%t%8%n%tMax. Password Age:%t%9%n%tForce Logoff:%t%10%n%tLockout Threshold:%t%11%n%tLockout Observation Window:%t%12%n%tLockout Duration:%t%13%n%tPassword Properties:%t%14%n%tMin. Password Length:%t%15%n%tPassword History Length:%t%16%n%tMachine Account Quota:%t%17%n%tMixed Domain Mode:%t%18%n%tDomain Behavior Version:%t%19%n%tOEM Information:%t%20%n
0x284	User Account Locked Out:%n%tTarget Account Name:%t%1%n%tTarget Account ID:%t%3%n%tCaller Machine Name:%t%2%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n	User Account Locked Out:%n%tTarget Account Name:%t%1%n%tTarget Account ID:%t%3%n%tCaller Machine Name:%t%2%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n
0x285	Computer Account Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges%t%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tDisplay Name:%t%9%n%tUser Principal Name:%t%10%n%tHome Directory:%t%11%n%tHome Drive:%t%12%n%tScript Path:%t%13%n%tProfile Path:%t%14%n%tUser Workstations:%t%15%n%tPassword Last Set:%t%16%n%tAccount Expires:%t%17%n%tPrimary Group ID:%t%18%n%tAllowedToDelegateTo:%t%19%n%tOld UAC Value:%t%20%n%tNew UAC Value:%t%21%n%tUser Account Control:%t%22%n%tUser Parameters:%t%23%n%tSid History:%t%24%n%tLogon Hours:%t%25%n%tDNS Host Name:%t%26%n%tService Principal Names:%t%27%n	Computer Account Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges%t%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tDisplay Name:%t%9%n%tUser Principal Name:%t%10%n%tHome Directory:%t%11%n%tHome Drive:%t%12%n%tScript Path:%t%13%n%tProfile Path:%t%14%n%tUser Workstations:%t%15%n%tPassword Last Set:%t%16%n%tAccount Expires:%t%17%n%tPrimary Group ID:%t%18%n%tAllowedToDelegateTo:%t%19%n%tOld UAC Value:%t%20%n%tNew UAC Value:%t%21%n%tUser Account Control:%t%22%n%tUser Parameters:%t%23%n%tSid History:%t%24%n%tLogon Hours:%t%25%n%tDNS Host Name:%t%26%n%tService Principal Names:%t%27%n
0x286	Computer Account Changed:%n%t%1%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%nChanged Attributes:%n%tSam Account Name:%t%9%n%tDisplay Name:%t%10%n%tUser Principal Name:%t%11%n%tHome Directory:%t%12%n%tHome Drive:%t%13%n%tScript Path:%t%14%n%tProfile Path:%t%15%n%tUser Workstations:%t%16%n%tPassword Last Set:%t%17%n%tAccount Expires:%t%18%n%tPrimary Group ID:%t%19%n%tAllowedToDelegateTo:%t%20%n%tOld UAC Value:%t%21%n%tNew UAC Value:%t%22%n%tUser Account Control:%t%23%n%tUser Parameters:%t%24%n%tSid History:%t%25%n%tLogon Hours:%t%26%n%tDNS Host Name:%t%27%n%tService Principal Names:%t%28%n	Computer Account Changed:%n%t%1%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%nChanged Attributes:%n%tSam Account Name:%t%9%n%tDisplay Name:%t%10%n%tUser Principal Name:%t%11%n%tHome Directory:%t%12%n%tHome Drive:%t%13%n%tScript Path:%t%14%n%tProfile Path:%t%15%n%tUser Workstations:%t%16%n%tPassword Last Set:%t%17%n%tAccount Expires:%t%18%n%tPrimary Group ID:%t%19%n%tAllowedToDelegateTo:%t%20%n%tOld UAC Value:%t%21%n%tNew UAC Value:%t%22%n%tUser Account Control:%t%23%n%tUser Parameters:%t%24%n%tSid History:%t%25%n%tLogon Hours:%t%26%n%tDNS Host Name:%t%27%n%tService Principal Names:%t%28%n
0x287	Computer Account Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Computer Account Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x288	Security Disabled Local Group Created:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Disabled Local Group Created:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x289	Security Disabled Local Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Disabled Local Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x28A	Security Disabled Local Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Disabled Local Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x28B	Security Disabled Local Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Disabled Local Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x28C	Security Disabled Local Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Security Disabled Local Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x28D	Security Disabled Global Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Disabled Global Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x28E	Security Disabled Global Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Disabled Global Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x28F	Security Disabled Global Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Disabled Global Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x290	Security Disabled Global Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Disabled Global Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x291	Security Disabled Global Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Security Disabled Global Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x292	Security Enabled Universal Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Enabled Universal Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x293	Security Enabled Universal Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Enabled Universal Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x294	Security Enabled Universal Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Enabled Universal Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x295	Security Enabled Universal Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Enabled Universal Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x296	Security Enabled Universal Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Security Enabled Universal Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x297	Security Disabled Universal Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Disabled Universal Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x298	Security Disabled Universal Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Security Disabled Universal Group Changed:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x299	Security Disabled Universal Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Disabled Universal Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x29A	Security Disabled Universal Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Security Disabled Universal Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x29B	Security Disabled Universal Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Security Disabled Universal Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x29C	Group Type Changed:%n%t%1%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%n	Group Type Changed:%n%t%1%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%n
0x29D	Add SID History:%n%tSource Account Name:%t%1%n%tSource Account ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n%tSidList:%t%10%n	Add SID History:%n%tSource Account Name:%t%1%n%tSource Account ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n%tSidList:%t%10%n
0x29E	Add SID History:%n%tSource Account Name:%t%1%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%n	Add SID History:%n%tSource Account Name:%t%1%n%tTarget Account Name:%t%2%n%tTarget Domain:%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%n
0x29F	User Account Unlocked:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n	User Account Unlocked:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n
0x2A0	Authentication Ticket Request:%n%tUser Name:%t%t%1%n%tSupplied Realm Name:%t%2%n%tUser ID:%t%t%t%3%n%tService Name:%t%t%4%n%tService ID:%t%t%5%n%tTicket Options:%t%t%6%n%tResult Code:%t%t%7%n%tTicket Encryption Type:%t%8%n%tPre-Authentication Type:%t%9%n%tClient Address:%t%t%10%n%tCertificate Issuer Name:%t%11%n%tCertificate Serial Number:%t%12%n%tCertificate Thumbprint:%t%13%n	Authentication Ticket Request:%n%tUser Name:%t%t%1%n%tSupplied Realm Name:%t%2%n%tUser ID:%t%t%t%3%n%tService Name:%t%t%4%n%tService ID:%t%t%5%n%tTicket Options:%t%t%6%n%tResult Code:%t%t%7%n%tTicket Encryption Type:%t%8%n%tPre-Authentication Type:%t%9%n%tClient Address:%t%t%10%n%tCertificate Issuer Name:%t%11%n%tCertificate Serial Number:%t%12%n%tCertificate Thumbprint:%t%13%n
0x2A1	Service Ticket Request:%n%tUser Name:%t%t%1%n%tUser Domain:%t%t%2%n%tService Name:%t%t%3%n%tService ID:%t%t%4%n%tTicket Options:%t%t%5%n%tTicket Encryption Type:%t%6%n%tClient Address:%t%t%7%n%tFailure Code:%t%t%8%n%tLogon GUID:%t%t%9%n%tTransited Services:%t%10%n	Service Ticket Request:%n%tUser Name:%t%t%1%n%tUser Domain:%t%t%2%n%tService Name:%t%t%3%n%tService ID:%t%t%4%n%tTicket Options:%t%t%5%n%tTicket Encryption Type:%t%6%n%tClient Address:%t%t%7%n%tFailure Code:%t%t%8%n%tLogon GUID:%t%t%9%n%tTransited Services:%t%10%n
0x2A2	Service Ticket Renewed:%n%tUser Name:%t%1%n%tUser Domain:%t%2%n%tService Name:%t%3%n%tService ID:%t%4%n%tTicket Options:%t%5%n%tTicket Encryption Type:%t%6%n%tClient Address:%t%7%n	Service Ticket Renewed:%n%tUser Name:%t%1%n%tUser Domain:%t%2%n%tService Name:%t%3%n%tService ID:%t%4%n%tTicket Options:%t%5%n%tTicket Encryption Type:%t%6%n%tClient Address:%t%7%n
0x2A3	Pre-authentication failed:%n%tUser Name:%t%1%n%tUser ID:%t%t%2%n%tService Name:%t%3%n%tPre-Authentication Type:%t%4%n%tFailure Code:%t%5%n%tClient Address:%t%6%n%tCertificate Issuer Name:%t%7%n%tCertificate Serial Number:%t%8%n%tCertificate Thumbprint:%t%9%n	Pre-authentication failed:%n%tUser Name:%t%1%n%tUser ID:%t%t%2%n%tService Name:%t%3%n%tPre-Authentication Type:%t%4%n%tFailure Code:%t%5%n%tClient Address:%t%6%n%tCertificate Issuer Name:%t%7%n%tCertificate Serial Number:%t%8%n%tCertificate Thumbprint:%t%9%n
0x2A4	Authentication Ticket Request Failed:%n%tUser Name:%t%1%n%tSupplied Realm Name:%t%2%n%tService Name:%t%3%n%tTicket Options:%t%4%n%tFailure Code:%t%5%n%tClient Address:%t%6%n	Authentication Ticket Request Failed:%n%tUser Name:%t%1%n%tSupplied Realm Name:%t%2%n%tService Name:%t%3%n%tTicket Options:%t%4%n%tFailure Code:%t%5%n%tClient Address:%t%6%n
0x2A5	Service Ticket Request Failed:%n%tUser Name:%t%1%n%tUser Domain:%t%2%n%tService Name:%t%3%n%tTicket Options:%t%4%n%tFailure Code:%t%5%n%tClient Address:%t%6%n	Service Ticket Request Failed:%n%tUser Name:%t%1%n%tUser Domain:%t%2%n%tService Name:%t%3%n%tTicket Options:%t%4%n%tFailure Code:%t%5%n%tClient Address:%t%6%n
0x2A6	Account Mapped for Logon.%nMapping Attempted By:%n%t%1%nClient Name:%n%t%2%n%tMapped Name:%n%t%3%n	Account Mapped for Logon.%nMapping Attempted By:%n%t%1%nClient Name:%n%t%2%n%tMapped Name:%n%t%3%n
0x2A7	The name:%n%t%2%ncould not be mapped for logon by:%t%1%n	The name:%n%t%2%ncould not be mapped for logon by:%t%1%n
0x2A8	Logon attempt by:%t%1%nLogon account:%t%2%nSource Workstation:%t%3%nError Code:%t%4%n	Logon attempt by:%t%1%nLogon account:%t%2%nSource Workstation:%t%3%nError Code:%t%4%n
0x2A9	The logon to account: %2%nby: %1%nfrom workstation: %3%nfailed. The error code was: %4%n	The logon to account: %2%nby: %1%nfrom workstation: %3%nfailed. The error code was: %4%n
0x2AA	Session reconnected to winstation:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession Name:%t%4%n%tClient Name:%t%5%n%tClient Address:%t%6	Session reconnected to winstation:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession Name:%t%4%n%tClient Name:%t%5%n%tClient Address:%t%6
0x2AB	Session disconnected from winstation:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession Name:%t%4%n%tClient Name:%t%5%n%tClient Address:%t%6	Session disconnected from winstation:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession Name:%t%4%n%tClient Name:%t%5%n%tClient Address:%t%6
0x2AC	Set ACLs of members in administrators groups:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Set ACLs of members in administrators groups:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x2AD	Account Name Changed:%n%tOld Account Name:%t%1%n%tNew Account Name:%t%2%n%tTarget Domain:%t%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%n	Account Name Changed:%n%tOld Account Name:%t%1%n%tNew Account Name:%t%2%n%tTarget Domain:%t%t%3%n%tTarget Account ID:%t%4%n%tCaller User Name:%t%5%n%tCaller Domain:%t%6%n%tCaller Logon ID:%t%7%n%tPrivileges:%t%8%n
0x2AE	Password of the following user accessed:%n%tTarget User Name:%t%1%n%tTarget User Domain:%t%t%2%nBy user:%n%tCaller User Name:%t%3%n%tCaller Domain:%t%t%4%n%tCaller Logon ID:%t%t%5%n	Password of the following user accessed:%n%tTarget User Name:%t%1%n%tTarget User Domain:%t%t%2%nBy user:%n%tCaller User Name:%t%3%n%tCaller Domain:%t%t%4%n%tCaller Logon ID:%t%t%5%n
0x2AF	Basic Application Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Basic Application Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x2B0	Basic Application Group Changed:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	Basic Application Group Changed:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x2B1	Basic Application Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Basic Application Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x2B2	Basic Application Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Basic Application Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x2B3	Basic Application Group Non-Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Basic Application Group Non-Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x2B4	Basic Application Group Non-Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	Basic Application Group Non-Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x2B5	Basic Application Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	Basic Application Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x2B6	LDAP Query Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	LDAP Query Group Created:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nAttributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x2B7	LDAP Query Group Changed:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n	LDAP Query Group Changed:%n%tNew Account Name:%t%1%n%tNew Domain:%t%2%n%tNew Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%nChanged Attributes:%n%tSam Account Name:%t%8%n%tSid History:%t%9%n
0x2B8	LDAP Query Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n	LDAP Query Group Deleted:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n
0x2B9	Password Policy Checking API is called:%n%tCaller Username:%t%1%n%tCaller Domain:%t%2%n%tCaller Logon ID:%t%3%n%tCaller Workstation:%t%4%n%tProvided User Name (unauthenticated):%t%5%n%tStatus Code:%t%6%n	Password Policy Checking API is called:%n%tCaller Username:%t%1%n%tCaller Domain:%t%2%n%tCaller Logon ID:%t%3%n%tCaller Workstation:%t%4%n%tProvided User Name (unauthenticated):%t%5%n%tStatus Code:%t%6%n
0x2BA	An attempt to set the Directory Services Restore Modeadministrator password has been made.%n%tCaller Username:%t%1%n%tCaller Domain:%t%2%n%tCaller Logon ID:%t%3%n%tCaller Workstation:%t%4%n%tStatus Code:%t%5%n	An attempt to set the Directory Services Restore Modeadministrator password has been made.%n%tCaller Username:%t%1%n%tCaller Domain:%t%2%n%tCaller Logon ID:%t%3%n%tCaller Workstation:%t%4%n%tStatus Code:%t%5%n
0x2BB	RODC SpecifiC Local Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	RODC SpecifiC Local Group Member Added:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x2BC	RODC Specific Local Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n	RODC Specific Local Group Member Removed:%n%tMember Name:%t%1%n%tMember ID:%t%2%n%tTarget Account Name:%t%3%n%tTarget Domain:%t%4%n%tTarget Account ID:%t%5%n%tCaller User Name:%t%6%n%tCaller Domain:%t%7%n%tCaller Logon ID:%t%8%n%tPrivileges:%t%9%n
0x2BD	An attempt was made to query the existence of a blank password for an account:%n%tCaller Username:%t%1%n%tCaller Domain:%t%2%n%tCaller Logon ID:%t%3%n%tCaller Workstation:%t%4%n%tTarget Account Name:%t%5%n%tTarget Account Domain:%t%6%n	An attempt was made to query the existence of a blank password for an account:%n%tCaller Username:%t%1%n%tCaller Domain:%t%2%n%tCaller Logon ID:%t%3%n%tCaller Workstation:%t%4%n%tTarget Account Name:%t%5%n%tTarget Account Domain:%t%6%n
0x2C0	Workstation is locked:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n	Workstation is locked:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n
0x2C1	Workstation is unlocked:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n	Workstation is unlocked:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n
0x2C2	Screen saver is invoked:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n	Screen saver is invoked:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n
0x2C3	Screen saver is dismissed:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n	Screen saver is dismissed:%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%t%3%n%tSession ID:%t%4%n
0x2D0	RPC detected an integrity violation while decrypting an incoming message.%n%tPeer Name:%t%1%n%tProtocol Sequence:%t%2%n%tSecurity Error:%t%3%n	RPC detected an integrity violation while decrypting an incoming message.%n%tPeer Name:%t%1%n%tProtocol Sequence:%t%2%n%tSecurity Error:%t%3%n
0x2D4	A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.%n%nAccount Information:%n%tAccount Name:%t%t%1%n%tSupplied Realm Name:%t%2%n%tUser ID:%t%t%t%3%n%nAuthentication Policy Information:%n%tSilo Name:%t%t%16%n%tPolicy Name:%t%t%17%n%tTGT Lifetime:%t%t%18%n%nDevice Information:%n%tDevice Name:%t%t%4%n%nService Information:%n%tService Name:%t%t%5%n%tService ID:%t%t%6%n%nNetwork Information:%n%tClient Address:%t%t%11%n%tClient Port:%t%t%12%n%nAdditional Information:%n%tTicket Options:%t%t%7%n%tResult Code:%t%t%8%n%tTicket Encryption Type:%t%9%n%tPre-Authentication Type:%t%10%n%nCertificate Information:%n%tCertificate Issuer Name:%t%t%13%n%tCertificate Serial Number:%t%14%n%tCertificate Thumbprint:%t%t%15%n%nCertificate information is only provided if a certificate was used for pre-authentication.%n%nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.	A Kerberos Ticket-granting-ticket (TGT) was denied because the device does not meet the access control restrictions.%n%nAccount Information:%n%tAccount Name:%t%t%1%n%tSupplied Realm Name:%t%2%n%tUser ID:%t%t%t%3%n%nAuthentication Policy Information:%n%tSilo Name:%t%t%16%n%tPolicy Name:%t%t%17%n%tTGT Lifetime:%t%t%18%n%nDevice Information:%n%tDevice Name:%t%t%4%n%nService Information:%n%tService Name:%t%t%5%n%tService ID:%t%t%6%n%nNetwork Information:%n%tClient Address:%t%t%11%n%tClient Port:%t%t%12%n%nAdditional Information:%n%tTicket Options:%t%t%7%n%tResult Code:%t%t%8%n%tTicket Encryption Type:%t%9%n%tPre-Authentication Type:%t%10%n%nCertificate Information:%n%tCertificate Issuer Name:%t%t%13%n%tCertificate Serial Number:%t%14%n%tCertificate Thumbprint:%t%t%15%n%nCertificate information is only provided if a certificate was used for pre-authentication.%n%nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.
0x2D5	A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.%n%nAccount Information:%n%tAccount Name:%t%t%1%n%tAccount Domain:%t%t%2%n%tLogon GUID:%t%t%11%n%nAuthentication Policy Information:%n%tSilo Name:%t%t%13%n%tPolicy Name:%t%t%14%n%nDevice Information:%n%tDevice Name:%t%t%3%n%nService Information:%n%tService Name:%t%t%4%n%tService ID:%t%t%5%n%nNetwork Information:%n%tClient Address:%t%t%8%n%tClient Port:%t%t%9%n%nAdditional Information:%n%tTicket Options:%t%t%6%n%tTicket Encryption Type:%t%7%n%tFailure Code:%t%t%10%n%tTransited Services:%t%12%n%nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.%n%nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.%n%nTicket options, encryption types, and failure codes are defined in RFC 4120.	A Kerberos service ticket was denied because the user, device, or both does not meet the access control restrictions.%n%nAccount Information:%n%tAccount Name:%t%t%1%n%tAccount Domain:%t%t%2%n%tLogon GUID:%t%t%11%n%nAuthentication Policy Information:%n%tSilo Name:%t%t%13%n%tPolicy Name:%t%t%14%n%nDevice Information:%n%tDevice Name:%t%t%3%n%nService Information:%n%tService Name:%t%t%4%n%tService ID:%t%t%5%n%nNetwork Information:%n%tClient Address:%t%t%8%n%tClient Port:%t%t%9%n%nAdditional Information:%n%tTicket Options:%t%t%6%n%tTicket Encryption Type:%t%7%n%tFailure Code:%t%t%10%n%tTransited Services:%t%12%n%nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.%n%nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.%n%nTicket options, encryption types, and failure codes are defined in RFC 4120.
0x2D6	NTLM authentication failed because the account was a member of the Protected User group.%n%nAccount Name:%t%1%nDevice Name:%t%2%nError Code:%t%3	NTLM authentication failed because the account was a member of the Protected User group.%n%nAccount Name:%t%1%nDevice Name:%t%2%nError Code:%t%3
0x2D7	NTLM authentication failed because access control restrictions are required.%n%nAccount Name:%t%1%nDevice Name:%t%2%nError Code:%t%3%n%nAuthentication Policy Information:%n%tSilo Name:%t%4%n%tPolicyName:%t%5	NTLM authentication failed because access control restrictions are required.%n%nAccount Name:%t%1%nDevice Name:%t%2%nError Code:%t%3%n%nAuthentication Policy Information:%n%tSilo Name:%t%4%n%tPolicyName:%t%5
0x2D8	Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.%n%nAccount Information:%n%tSecurity ID:%t%t%2%n%tAccount Name:%t%t%1%n%nService Information:%n%tService Name:%t%t%3%n%nNetwork Information:%n%tClient Address:%t%t%7%n%tClient Port:%t%t%8%n%nAdditional Information:%n%tTicket Options:%t%t%4%n%tFailure Code:%t%t%5%n%tPre-Authentication Type:%t%6%n%nCertificate Information:%n%tCertificate Issuer Name:%t%t%9%n%tCertificate Serial Number: %t%10%n%tCertificate Thumbprint:%t%t%11%n%nCertificate information is only provided if a certificate was used for pre-authentication.%n%nPre-authentication types, ticket options and failure codes are defined in RFC 4120.%n%nIf the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.	Kerberos preauthentication by using DES or RC4 failed because the account was a member of the Protected User group.%n%nAccount Information:%n%tSecurity ID:%t%t%2%n%tAccount Name:%t%t%1%n%nService Information:%n%tService Name:%t%t%3%n%nNetwork Information:%n%tClient Address:%t%t%7%n%tClient Port:%t%t%8%n%nAdditional Information:%n%tTicket Options:%t%t%4%n%tFailure Code:%t%t%5%n%tPre-Authentication Type:%t%6%n%nCertificate Information:%n%tCertificate Issuer Name:%t%t%9%n%tCertificate Serial Number: %t%10%n%tCertificate Thumbprint:%t%t%11%n%nCertificate information is only provided if a certificate was used for pre-authentication.%n%nPre-authentication types, ticket options and failure codes are defined in RFC 4120.%n%nIf the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
0x2D9	A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group.%n%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%3%n%tClient Address:%t%4	A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group.%n%n%tUser Name:%t%1%n%tDomain:%t%t%2%n%tLogon ID:%t%3%n%tClient Address:%t%4
0x2DE	Remove SID History:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n%tSidList:%t%8%n	Remove SID History:%n%tTarget Account Name:%t%1%n%tTarget Domain:%t%2%n%tTarget Account ID:%t%3%n%tCaller User Name:%t%4%n%tCaller Domain:%t%5%n%tCaller Logon ID:%t%6%n%tPrivileges:%t%7%n%tSidList:%t%8%n
0x300	Namespace collision detected:%n%tTarget type:%t%1%n%tTarget name:%t%2%n%tForest Root:%t%3%n%tTop Level Name:%t%4%n%tDNS Name:%t%5%n%tNetBIOS Name:%t%6%n%tSID:%t%t%7%n%tNew Flags:%t%8%n	Namespace collision detected:%n%tTarget type:%t%1%n%tTarget name:%t%2%n%tForest Root:%t%3%n%tTop Level Name:%t%4%n%tDNS Name:%t%5%n%tNetBIOS Name:%t%6%n%tSID:%t%t%7%n%tNew Flags:%t%8%n
0x301	Trusted Forest Information Entry Added:%n%tForest Root:%t%1%n%tForest Root SID:%t%2%n%tOperation ID:%t{%3,%4}%n%tEntry Type:%t%5%n%tFlags:%t%t%6%n%tTop Level Name:%t%7%n%tDNS Name:%t%8%n%tNetBIOS Name:%t%9%n%tDomain SID:%t%10%n%tAdded by%t:%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n	Trusted Forest Information Entry Added:%n%tForest Root:%t%1%n%tForest Root SID:%t%2%n%tOperation ID:%t{%3,%4}%n%tEntry Type:%t%5%n%tFlags:%t%t%6%n%tTop Level Name:%t%7%n%tDNS Name:%t%8%n%tNetBIOS Name:%t%9%n%tDomain SID:%t%10%n%tAdded by%t:%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n
0x302	Trusted Forest Information Entry Removed:%n%tForest Root:%t%1%n%tForest Root SID:%t%2%n%tOperation ID:%t{%3,%4}%n%tEntry Type:%t%5%n%tFlags:%t%t%6%n%tTop Level Name:%t%7%n%tDNS Name:%t%8%n%tNetBIOS Name:%t%9%n%tDomain SID:%t%10%n%tRemoved by%t:%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n	Trusted Forest Information Entry Removed:%n%tForest Root:%t%1%n%tForest Root SID:%t%2%n%tOperation ID:%t{%3,%4}%n%tEntry Type:%t%5%n%tFlags:%t%t%6%n%tTop Level Name:%t%7%n%tDNS Name:%t%8%n%tNetBIOS Name:%t%9%n%tDomain SID:%t%10%n%tRemoved by%t:%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n
0x303	Trusted Forest Information Entry Modified:%n%tForest Root:%t%1%n%tForest Root SID:%t%2%n%tOperation ID:%t{%3,%4}%n%tEntry Type:%t%5%n%tFlags:%t%t%6%n%tTop Level Name:%t%7%n%tDNS Name:%t%8%n%tNetBIOS Name:%t%9%n%tDomain SID:%t%10%n%tModified by%t:%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n	Trusted Forest Information Entry Modified:%n%tForest Root:%t%1%n%tForest Root SID:%t%2%n%tOperation ID:%t{%3,%4}%n%tEntry Type:%t%5%n%tFlags:%t%t%6%n%tTop Level Name:%t%7%n%tDNS Name:%t%8%n%tNetBIOS Name:%t%9%n%tDomain SID:%t%10%n%tModified by%t:%n%tClient User Name:%t%11%n%tClient Domain:%t%12%n%tClient Logon ID:%t%13%n
0x304	The certificate manager denied a pending certificate request.%n%nRequest ID:%t%1	The certificate manager denied a pending certificate request.%n%nRequest ID:%t%1
0x305	Certificate Services received a resubmitted certificate request.%n%nRequest ID:%t%1	Certificate Services received a resubmitted certificate request.%n%nRequest ID:%t%1
0x306	Certificate Services revoked a certificate.%n%nSerial No:%t%1%nReason:%t%2	Certificate Services revoked a certificate.%n%nSerial No:%t%1%nReason:%t%2
0x307	Certificate Services received a request to publish the certificate revocation list (CRL).%n%nNext Update:%t%1%nPublish Base:%t%2%nPublish Delta:%t%3	Certificate Services received a request to publish the certificate revocation list (CRL).%n%nNext Update:%t%1%nPublish Base:%t%2%nPublish Delta:%t%3
0x308	Certificate Services published the certificate revocation list (CRL).%n%nBase CRL:%t%1%nCRL No:%t%t%2%nKey Container:%t%3%nNext Publish:%t%4%nPublish URLs:%t%5	Certificate Services published the certificate revocation list (CRL).%n%nBase CRL:%t%1%nCRL No:%t%t%2%nKey Container:%t%3%nNext Publish:%t%4%nPublish URLs:%t%5
0x309	A certificate request extension changed.%n%nRequest ID:%t%1%nName:%t%2%nType:%t%3%nFlags:%t%4%nData:%t%5	A certificate request extension changed.%n%nRequest ID:%t%1%nName:%t%2%nType:%t%3%nFlags:%t%4%nData:%t%5
0x30A	One or more certificate request attributes changed.%n%nRequest ID:%t%1%nAttributes:%t%2	One or more certificate request attributes changed.%n%nRequest ID:%t%1%nAttributes:%t%2
0x30B	Certificate Services received a request to shut down.	Certificate Services received a request to shut down.
0x30C	Certificate Services backup started.%nBackup Type:%t%1	Certificate Services backup started.%nBackup Type:%t%1
0x30D	Certificate Services backup completed.	Certificate Services backup completed.
0x30E	Certificate Services restore started.	Certificate Services restore started.
0x30F	Certificate Services restore completed.	Certificate Services restore completed.
0x310	Certificate Services started.%n%nCertificate Database Hash:%t%1%nPrivate Key Usage Count:%t%2%nCA Certificate Hash:%t%3%nCA Public Key Hash:%t%4	Certificate Services started.%n%nCertificate Database Hash:%t%1%nPrivate Key Usage Count:%t%2%nCA Certificate Hash:%t%3%nCA Public Key Hash:%t%4
0x311	Certificate Services stopped.%n%nCertificate Database Hash:%t%1%nPrivate Key Usage Count:%t%2%nCA Certificate Hash:%t%3%nCA Public Key Hash:%t%4	Certificate Services stopped.%n%nCertificate Database Hash:%t%1%nPrivate Key Usage Count:%t%2%nCA Certificate Hash:%t%3%nCA Public Key Hash:%t%4
0x312	The security permissions for Certificate Services changed.%n%n%1	The security permissions for Certificate Services changed.%n%n%1
0x313	Certificate Services retrieved an archived key.%n%nRequest ID:%t%1	Certificate Services retrieved an archived key.%n%nRequest ID:%t%1
0x314	Certificate Services imported a certificate into its database.%n%nCertificate:%t%1%nRequest ID:%t%2	Certificate Services imported a certificate into its database.%n%nCertificate:%t%1%nRequest ID:%t%2
0x315	The audit filter for Certificate Services changed.%n%nFilter:%t%1	The audit filter for Certificate Services changed.%n%nFilter:%t%1
0x316	Certificate Services received a certificate request.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3	Certificate Services received a certificate request.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3
0x317	Certificate Services approved a certificate request and issued a certificate.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3%nDisposition:%t%4%nSKI:%t%t%5%nSubject:%t%6	Certificate Services approved a certificate request and issued a certificate.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3%nDisposition:%t%4%nSKI:%t%t%5%nSubject:%t%6
0x318	Certificate Services denied a certificate request.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3%nDisposition:%t%4%nSKI:%t%t%5%nSubject:%t%6	Certificate Services denied a certificate request.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3%nDisposition:%t%4%nSKI:%t%t%5%nSubject:%t%6
0x319	Certificate Services set the status of a certificate request to pending.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3%nDisposition:%t%4%nSKI:%t%t%5%nSubject:%t%6	Certificate Services set the status of a certificate request to pending.%n%nRequest ID:%t%1%nRequester:%t%2%nAttributes:%t%3%nDisposition:%t%4%nSKI:%t%t%5%nSubject:%t%6
0x31A	The certificate manager settings for Certificate Services changed.%n%nEnable:%t%1%n%n%2	The certificate manager settings for Certificate Services changed.%n%nEnable:%t%1%n%n%2
0x31B	A configuration entry changed in Certificate Services.%n%nNode:%t%1%nEntry:%t%2%nValue:%t%3	A configuration entry changed in Certificate Services.%n%nNode:%t%1%nEntry:%t%2%nValue:%t%3
0x31C	A property of Certificate Services changed.%n%nProperty:%t%1%nIndex:%t%2%nType:%t%3%nValue:%t%4	A property of Certificate Services changed.%n%nProperty:%t%1%nIndex:%t%2%nType:%t%3%nValue:%t%4
0x31D	Certificate Services archived a key.%n%nRequest ID:%t%1%nRequester:%t%2%nKRA Hashes:%t%3	Certificate Services archived a key.%n%nRequest ID:%t%1%nRequester:%t%2%nKRA Hashes:%t%3
0x31E	Certificate Services imported and archived a key.%n%nRequest ID:%t%1	Certificate Services imported and archived a key.%n%nRequest ID:%t%1
0x31F	Certificate Services published the CA certificate to Active Directory Domain Services.%n%nCertificate Hash:%t%1%nValid From:%t%2%nValid To:%t%3	Certificate Services published the CA certificate to Active Directory Domain Services.%n%nCertificate Hash:%t%1%nValid From:%t%2%nValid To:%t%3
0x320	One or more rows have been deleted from the certificate database.%n%nTable ID:%t%1%nFilter:%t%2%nRows Deleted:%t%3	One or more rows have been deleted from the certificate database.%n%nTable ID:%t%1%nFilter:%t%2%nRows Deleted:%t%3
0x321	Role separation enabled:%t%1	Role separation enabled:%t%1
0x322	Certificate Services template:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nTemplate Content:%n%7%nSecurity Descriptor:%n%8	Certificate Services template:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nTemplate Content:%n%7%nSecurity Descriptor:%n%8
0x323	Certificate Services template updated:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nOld Template Content:%n%8%n%nNew Template Content:%n%7	Certificate Services template updated:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nOld Template Content:%n%8%n%nNew Template Content:%n%7
0x324	Certificate Services template security updated:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nOld Template Content:%n%9%nOld Security Descriptor:%n%10%n%nNew Template Content:%n%7%nNew Security Descriptor:%n%8	Certificate Services template security updated:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nOld Template Content:%n%9%nOld Security Descriptor:%n%10%n%nNew Template Content:%n%7%nNew Security Descriptor:%n%8
0x325	Configuration of security log for this session:%tMaximum Log Size (KB): %1%n%tAction to take on reaching max log size: %2%n%tEvent age limit in days: %3%n	Configuration of security log for this session:%tMaximum Log Size (KB): %1%n%tAction to take on reaching max log size: %2%n%tEvent age limit in days: %3%n
0x326	Per User Audit Policy table created.%n%tNumber of elements:%t%1%n%tPolicy ID:%t%2%n	Per User Audit Policy table created.%n%tNumber of elements:%t%1%n%tPolicy ID:%t%2%n
0x327	Per user auditing policy set for user:%n%tTarget user:%t%1%n%tPolicy ID:%t%2%n%tCategory Settings:%n%t System:%t%3%n%t Logon:%t%4%n%t Object Access%t%5%n%t Privilege Use:%t%6%n%t Detailed Tracking:%t%7%n%t Policy Change:%t%8%n%t Account Management:%t%9%n%t DS Access:%t%10%n%t Account Logon:%t%11%n	Per user auditing policy set for user:%n%tTarget user:%t%1%n%tPolicy ID:%t%2%n%tCategory Settings:%n%t System:%t%3%n%t Logon:%t%4%n%t Object Access%t%5%n%t Privilege Use:%t%6%n%t Detailed Tracking:%t%7%n%t Policy Change:%t%8%n%t Account Management:%t%9%n%t DS Access:%t%10%n%t Account Logon:%t%11%n
0x328	A security event source has attempted to register.%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tSource Name:%t%7%n%tProcess Id:%t%8%n%tEvent Source Id:%t%9%n%tImage File Name:%t%10%n	A security event source has attempted to register.%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tSource Name:%t%7%n%tProcess Id:%t%8%n%tEvent Source Id:%t%9%n%tImage File Name:%t%10%n
0x329	A security event source has attempted to unregister.%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tSource Name:%t%7%n%tProcess Id:%t%8%n%tEvent Source Id:%t%9%n%tImage File Name:%t%10%n	A security event source has attempted to unregister.%n%tPrimary User Name:%t%1%n%tPrimary Domain:%t%2%n%tPrimary Logon ID:%t%3%n%tClient User Name:%t%4%n%tClient Domain:%t%5%n%tClient Logon ID:%t%6%n%tSource Name:%t%7%n%tProcess Id:%t%8%n%tEvent Source Id:%t%9%n%tImage File Name:%t%10%n
0x32A	CrashOnAuditFail value has changed.%n%tNew value of CrashOnAuditFail:%t%1%n	CrashOnAuditFail value has changed.%n%tNew value of CrashOnAuditFail:%t%1%n
0x32B	Auditing settings on object changed:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tProcess ID:%t%5%n%tImage File Name:%t%6%n%n%tPrimary User Name:%t%7%n%tPrimary Domain:%t%8%n%tPrimary Logon ID:%t%9%n%tClient User Name:%t%10%n%tClient Domain:%t%11%n%tClient Logon ID:%t%12%n%tOriginal Security Descriptor:%t%13%n%tNew Security Descriptor:%t%14%n	Auditing settings on object changed:%n%tObject Server:%t%1%n%tObject Type:%t%2%n%tObject Name:%t%3%n%tHandle ID:%t%4%n%tProcess ID:%t%5%n%tImage File Name:%t%6%n%n%tPrimary User Name:%t%7%n%tPrimary Domain:%t%8%n%tPrimary Logon ID:%t%9%n%tClient User Name:%t%10%n%tClient Domain:%t%11%n%tClient Logon ID:%t%12%n%tOriginal Security Descriptor:%t%13%n%tNew Security Descriptor:%t%14%n
0x32E	Special Groups Logon table created.%nSpecial Groups:%t%1%n	Special Groups Logon table created.%nSpecial Groups:%t%1%n
0x330	Per User Audit Policy Change:%n User:%t%t%1%n Category:%t%2%n Sub Category:%t%3%n Sub Category Guid:%t%4%n Changes:%t%5%n%nChanged By:%n User Name:%t%6%n Domain Name:%t%7%n Logon ID:%t%8	Per User Audit Policy Change:%n User:%t%t%1%n Category:%t%2%n Sub Category:%t%3%n Sub Category Guid:%t%4%n Changes:%t%5%n%nChanged By:%n User Name:%t%6%n Domain Name:%t%7%n Logon ID:%t%8
0x340	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tSource Addr:%t%3%n%tNaming Context:%t%4%n%tOptions:%t%5%n%tStatus Code:%t%6%n	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tSource Addr:%t%3%n%tNaming Context:%t%4%n%tOptions:%t%5%n%tStatus Code:%t%6%n
0x343	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tDest. Addr:%t%3%n%tNaming Context:%t%4%n%tOptions:%t%5%n%tStatus Code:%t%6%n	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tDest. Addr:%t%3%n%tNaming Context:%t%4%n%tOptions:%t%5%n%tStatus Code:%t%6%n
0x344	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tNaming Context:%t%3%n%tOptions:%t%4%n%tSession ID:%t%5%n%tStart USN:%t%6%n	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tNaming Context:%t%3%n%tOptions:%t%4%n%tSession ID:%t%5%n%tStart USN:%t%6%n
0x345	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tNaming Context:%t%3%n%tOptions:%t%4%n%tSession ID:%t%5%n%tEnd USN:%t%6%n%tStatus Code:%t%7%n	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tNaming Context:%t%3%n%tOptions:%t%4%n%tSession ID:%t%5%n%tEnd USN:%t%6%n%tStatus Code:%t%7%n
0x346	%tSession ID:%t%1%n%tObject:%t%2%n%tAttribute:%t%3%n%tType of change:%t%4%n%tNew Value:%t%5%n%tUSN:%t%6%n%tStatus Code:%t%7%n	%tSession ID:%t%1%n%tObject:%t%2%n%tAttribute:%t%3%n%tType of change:%t%4%n%tNew Value:%t%5%n%tUSN:%t%6%n%tStatus Code:%t%7%n
0x347	%tReplication Event:%t%1%n%tAudit Status Code:%t%2%n	%tReplication Event:%t%1%n%tAudit Status Code:%t%2%n
0x348	%tReplication Event:%t%1%n%tAudit Status Code:%t%2%n%tReplication Status Code:%t%3%n	%tReplication Event:%t%1%n%tAudit Status Code:%t%2%n%tReplication Status Code:%t%3%n
0x349	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tObject:%t%3%n%tOptions:%t%4%n%tStatus Code:%t%5%n	%tDestination DRA:%t%1%n%tSource DRA:%t%2%n%tObject:%t%3%n%tOptions:%t%4%n%tStatus Code:%t%5%n
0x350	The following policy was active when the Windows Firewall started.%n%nGroup Policy applied: %1%nProfile used: %2%nOperational mode: %3%nAllow remote administration: %4%nAllow unicast responses to multicast/broadcast traffic: %5%nSecurity Logging:%n Log dropped packets: %6%n Log successful connections %7	The following policy was active when the Windows Firewall started.%n%nGroup Policy applied: %1%nProfile used: %2%nOperational mode: %3%nAllow remote administration: %4%nAllow unicast responses to multicast/broadcast traffic: %5%nSecurity Logging:%n Log dropped packets: %6%n Log successful connections %7
0x351	A rule was listed when the Windows Firewall started.%n%nProfile used: %1%nRule:%n Rule Id: %2%n Rule Name: %3	A rule was listed when the Windows Firewall started.%n%nProfile used: %1%nRule:%n Rule Id: %2%n Rule Name: %3
0x352	A change has been made to Windows Firewall exception list. A rule was added.%n%nProfile changed: %1%nAdded Rule:%n Rule Id: %2%n Rule Name: %3	A change has been made to Windows Firewall exception list. A rule was added.%n%nProfile changed: %1%nAdded Rule:%n Rule Id: %2%n Rule Name: %3
0x353	A change has been made to Windows Firewall exception list. A rule was modified.%n%nProfile changed: %1%nModified Rule:%n Rule Id: %2%n Rule Name: %3	A change has been made to Windows Firewall exception list. A rule was modified.%n%nProfile changed: %1%nModified Rule:%n Rule Id: %2%n Rule Name: %3
0x354	A change has been made to Windows Firewall exception list. A rule was deleted.%n%nProfile changed: %1%nDeleted Rule:%n Rule Id: %2%n Rule Name: %3	A change has been made to Windows Firewall exception list. A rule was deleted.%n%nProfile changed: %1%nDeleted Rule:%n Rule Id: %2%n Rule Name: %3
0x355	A change has been made to Windows Firewall settings. Settings restored to factory defaults.%n	A change has been made to Windows Firewall settings. Settings restored to factory defaults.%n
0x356	A Windows Firewall setting has changed.%n%nProfile changed: %1%nNew Setting:%n Type: %2%n Value: %3	A Windows Firewall setting has changed.%n%nProfile changed: %1%nNew Setting:%n Type: %2%n Value: %3
0x357	A rule has been ignored because its major version number was not recognized by Windows Firewall.%n%nProfile: %1%nIgnored Rule:%n Id:%2%n Name:%3	A rule has been ignored because its major version number was not recognized by Windows Firewall.%n%nProfile: %1%nIgnored Rule:%n Id:%2%n Name:%3
0x358	A rule has been partially ignored because its minor version number was not recognized by Windows Firewall.%n%nProfile: %1%nPartially Ignored Rule:%n Id:%2%n Name:%3	A rule has been partially ignored because its minor version number was not recognized by Windows Firewall.%n%nProfile: %1%nPartially Ignored Rule:%n Id:%2%n Name:%3
0x359	A rule has been rejected by Windows Firewall.%n%nProfile: %1%nReason for Rejection:%2%nRule:%n Id:%3%n Name:%4	A rule has been rejected by Windows Firewall.%n%nProfile: %1%nReason for Rejection:%2%nRule:%n Id:%3%n Name:%4
0x35A	Windows Firewall group policy settings have been applied.	Windows Firewall group policy settings have been applied.
0x35B	The Windows Firewall group policy settings have been removed.	The Windows Firewall group policy settings have been removed.
0x35C	The Windows Firewall has switched the active policy profile.%n%nActive profile: %1	The Windows Firewall has switched the active policy profile.%n%nActive profile: %1
0x35D	Windows Firewall did not apply the following rule:%nRule:%n Id:%1%n Name:%2%nReason: %3 resolved to an empty set.	Windows Firewall did not apply the following rule:%nRule:%n Id:%1%n Name:%2%nReason: %3 resolved to an empty set.
0x35E	Windows Firewall did not apply the following rule:%nRule:%n Id:%1%n Name:%2%nError: %3%nReason: %4	Windows Firewall did not apply the following rule:%nRule:%n Id:%1%n Name:%2%nError: %3%nReason: %4
0x360	IPSec inbound packet integrity check failed:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n%tNumber Of Packets:%t%3%nReceived packet from over a security association that failed data integrity verification. This could be a temporary problem; if it persists it may indicate either a poor network condition or that packets are being modified in transit to the system.%n	IPSec inbound packet integrity check failed:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n%tNumber Of Packets:%t%3%nReceived packet from over a security association that failed data integrity verification. This could be a temporary problem; if it persists it may indicate either a poor network condition or that packets are being modified in transit to the system.%n
0x361	IPSec inbound packet replay check failed:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n %tNumber of Packets:%t%3%nReceived packet from over a security association with a sequence number for a packet already processed by the system.This could be a temporary problem; if it persists it may indicate a replay attack against the system.%n	IPSec inbound packet replay check failed:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n %tNumber of Packets:%t%3%nReceived packet from over a security association with a sequence number for a packet already processed by the system.This could be a temporary problem; if it persists it may indicate a replay attack against the system.%n
0x362	Received a packet over a security association with a low sequence number. IPsec inbound packet replay check failed.This may indicate a either network or hardware problem or that a replay attack is in process. Check your IPsec peer network for errors. To check for a replay attack shutdown the peer device and check if these messages persist. If the messages persist it may indicate a replay attack.:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n %tNumber of Packets:%t%3%n	Received a packet over a security association with a low sequence number. IPsec inbound packet replay check failed.This may indicate a either network or hardware problem or that a replay attack is in process. Check your IPsec peer network for errors. To check for a replay attack shutdown the peer device and check if these messages persist. If the messages persist it may indicate a replay attack.:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n %tNumber of Packets:%t%3%n
0x363	IPSec received inbound clear text packet that should have been secured:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n%tNumber of Packets:%t%3%n	IPSec received inbound clear text packet that should have been secured:%n%tPacket Source:%t%1%n%tInbound SA:%t%2%n%tNumber of Packets:%t%3%n
0x364	The Windows Filter Platform blocked a packet .:%n%tDirection:%t%1%n%tLocal Address:%t%2%n%tLocal Port:%t%3%n%tRemote Address:%t%4%n%tRemote Port:%t%5%n%tProtocol:%t%6%n%tFilter LUID:%t%7%n%tLayer Id:%t%8%n	The Windows Filter Platform blocked a packet .:%n%tDirection:%t%1%n%tLocal Address:%t%2%n%tLocal Port:%t%3%n%tRemote Address:%t%4%n%tRemote Port:%t%5%n%tProtocol:%t%6%n%tFilter LUID:%t%7%n%tLayer Id:%t%8%n
0x365	A more restrictive Windows Filtering Platform filter has blocked the packet.:%n%tApplication:%t%1%n%tDirection:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tDestination Address:%t%5%n%tDestination Port:%t%6%n%tProtocol:%t%7%n%tFilter run-time ID:%t%8%n%tLayer:%t%9%n	A more restrictive Windows Filtering Platform filter has blocked the packet.:%n%tApplication:%t%1%n%tDirection:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tDestination Address:%t%5%n%tDestination Port:%t%6%n%tProtocol:%t%7%n%tFilter run-time ID:%t%8%n%tLayer:%t%9%n
0x366	Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tFilter run-time ID:%t%5%n%tLayer:%t%6%n	Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tFilter run-time ID:%t%5%n%tLayer:%t%6%n
0x367	Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tFilter run-time ID:%t%5%n%tLayer:%t%6%n	Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tFilter run-time ID:%t%5%n%tLayer:%t%6%n
0x368	Windows Filtering Platform has permitted a connection to take place.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tDestination Address:%t%6%n%tDestination Port:%t%7%n%tDirection:%t%8%n%tFilter run-time ID:%t%9%n%tLayer:%t%10%n	Windows Filtering Platform has permitted a connection to take place.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tDestination Address:%t%6%n%tDestination Port:%t%7%n%tDirection:%t%8%n%tFilter run-time ID:%t%9%n%tLayer:%t%10%n
0x369	Windows Filtering Platform has blocked a connection from taking place.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tDestination Address:%t%6%n%tDestination Port:%t%7%n%tDirection:%t%8%n%tFilter run-time ID:%t%9%n%tLayer:%t%10%n	Windows Filtering Platform has blocked a connection from taking place.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tDestination Address:%t%6%n%tDestination Port:%t%7%n%tDirection:%t%8%n%tFilter run-time ID:%t%9%n%tLayer:%t%10%n
0x36A	Windows Filtering Platform has permitted a bind to a local port.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tFilter run-time ID:%t%6%n%tLayer:%t%7%n	Windows Filtering Platform has permitted a bind to a local port.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tFilter run-time ID:%t%6%n%tLayer:%t%7%n
0x36B	Windows Filtering Platform has blocked a bind to a local port.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tFilter run-time ID:%t%6%n%tLayer:%t%7%n	Windows Filtering Platform has blocked a bind to a local port.:%n%tProcess ID:%t%1%n%tApplication:%t%2%n%tSource Address:%t%3%n%tSource Port:%t%4%n%tProtocol:%t%5%n%tFilter run-time ID:%t%6%n%tLayer:%t%7%n
0x36D	Special groups have been assigned to a token:%n%tUser Sid:%t%1%n%tUser Name:%t%2%n%tDomain:%t%t%3%n%tLogon ID:%t%t%4%n%tLogon GUID:%t%5%n%tSpecial Groups assigned:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Logon Guid:%t%10%n	Special groups have been assigned to a token:%n%tUser Sid:%t%1%n%tUser Name:%t%2%n%tDomain:%t%t%3%n%tLogon ID:%t%t%4%n%tLogon GUID:%t%5%n%tSpecial Groups assigned:%t%6%n%tCaller User Name:%t%7%n%tCaller Domain:%t%8%n%tCaller Logon ID:%t%9%n%tCaller Logon Guid:%t%10%n
0x370	During IPSec main mode SA negotiation, IKE/Authip received an invalid ISAKMP packet. This could indicate a poor network condition or an attempt to modify or replay this negotiation.Local address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%n	During IPSec main mode SA negotiation, IKE/Authip received an invalid ISAKMP packet. This could indicate a poor network condition or an attempt to modify or replay this negotiation.Local address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%n
0x371	During IPSec quick mode SA negotiation, IKE/Authip received an invalid ISAKMP packet. This could indicate a poor network condition or an attempt to modify or replay this negotiation.Local address: %1%nLocal address mask: %2%nRemote address: %3%nRemote address mask: %4%nLocal port: %5%nRemote port: %6%nProtocol: %7%nEncapsulation type: %8%n	During IPSec quick mode SA negotiation, IKE/Authip received an invalid ISAKMP packet. This could indicate a poor network condition or an attempt to modify or replay this negotiation.Local address: %1%nLocal address mask: %2%nRemote address: %3%nRemote address mask: %4%nLocal port: %5%nRemote port: %6%nProtocol: %7%nEncapsulation type: %8%n
0x372	During IPSec user mode SA negotiation, Authip received an invalid ISAKMP packet. This could indicate a poor network condition or an attempt to modify or replay this negotiation.Local address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%n	During IPSec user mode SA negotiation, Authip received an invalid ISAKMP packet. This could indicate a poor network condition or an attempt to modify or replay this negotiation.Local address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%n
0x373	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode my Id: %7%nMain mode Peer Id: %8%nCipher algorithm: %9%nIntegrity algorithm: %10%nLifetime (seconds): %11%nMain mode impersonation: %12%nMain mode SA LUID: %13%n%nUser mode authentication method: %14%nUser mode my Id: %15%nUser mode peer Id: %16%nUser mode impersonation: %17%n	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode my Id: %7%nMain mode Peer Id: %8%nCipher algorithm: %9%nIntegrity algorithm: %10%nLifetime (seconds): %11%nMain mode impersonation: %12%nMain mode SA LUID: %13%n%nUser mode authentication method: %14%nUser mode my Id: %15%nUser mode peer Id: %16%nUser mode impersonation: %17%n
0x374	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode my Id: %7%nMain mode peer Id: %8%nCipher algorithm: %9%nIntegrity algorithm: %10%nLifetime (seconds): %11%nMain mode impersonation: %12%nMain mode SA LUID: %13%n%nUser mode authentication method: %14%nUser mode peer subject: %n%15%nUser mode peer issuing certificate authority: %n%16%nUser mode peer root certificate authority: %n%17%nUser mode peer SHA thumbprint: %n%18%nUser mode my subject: %n%19%nUser mode my SHA thumbprint: %n%20%nUser mode impersonation: %21%n	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode my Id: %7%nMain mode peer Id: %8%nCipher algorithm: %9%nIntegrity algorithm: %10%nLifetime (seconds): %11%nMain mode impersonation: %12%nMain mode SA LUID: %13%n%nUser mode authentication method: %14%nUser mode peer subject: %n%15%nUser mode peer issuing certificate authority: %n%16%nUser mode peer root certificate authority: %n%17%nUser mode peer SHA thumbprint: %n%18%nUser mode my subject: %n%19%nUser mode my SHA thumbprint: %n%20%nUser mode impersonation: %21%n
0x375	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode peer subject: %n%7%nMain mode peer issuing certificate authority: %n%8%nMain mode peer root certificate authority: %n%9%nMain mode peer SHA thumbprint: %n%10%nMain mode my subject: %n%11%nMain mode my SHA thumbprint: %n%12%nCipher algorithm: %13%nIntegrity algorithm: %14%nLifetime (seconds): %15%nMain mode impersonation: %16%nMain mode SA LUID: %17%n%nUser mode authentication method: %18%nUser mode my Id: %19%nUser mode peer Id: %20%nUser mode impersonation: %21%n	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode peer subject: %n%7%nMain mode peer issuing certificate authority: %n%8%nMain mode peer root certificate authority: %n%9%nMain mode peer SHA thumbprint: %n%10%nMain mode my subject: %n%11%nMain mode my SHA thumbprint: %n%12%nCipher algorithm: %13%nIntegrity algorithm: %14%nLifetime (seconds): %15%nMain mode impersonation: %16%nMain mode SA LUID: %17%n%nUser mode authentication method: %18%nUser mode my Id: %19%nUser mode peer Id: %20%nUser mode impersonation: %21%n
0x376	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode peer subject: %n%7%nMain mode peer issuing certificate authority: %n%8%nMain mode peer root certificate authority: %n%9%nMain mode peer SHA thumbprint: %n%10%nMain mode my subject: %n%11%nMain mode my SHA thumbprint: %n%12%nCipher algorithm: %13%nIntegrity algorithm: %14%nLifetime (seconds): %15%nMain mode impersonation: %16%nMain mode SA LUID: %17%n%nUser mode authentication method: %18%nUser mode peer subject: %n%19%nUser mode peer issuing certificate authority: %n%20%nUser mode peer root certificate authority: %n%21%nUser mode peer SHA thumbprint: %n%22%nUser mode my subject: %n%23%nUser mode my SHA thumbprint: %n%24%nUser mode impersonation: %25%n	IPSec main mode and user mode security associations established.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nMain mode authentication method: %6%nMain mode peer subject: %n%7%nMain mode peer issuing certificate authority: %n%8%nMain mode peer root certificate authority: %n%9%nMain mode peer SHA thumbprint: %n%10%nMain mode my subject: %n%11%nMain mode my SHA thumbprint: %n%12%nCipher algorithm: %13%nIntegrity algorithm: %14%nLifetime (seconds): %15%nMain mode impersonation: %16%nMain mode SA LUID: %17%n%nUser mode authentication method: %18%nUser mode peer subject: %n%19%nUser mode peer issuing certificate authority: %n%20%nUser mode peer root certificate authority: %n%21%nUser mode peer SHA thumbprint: %n%22%nUser mode my subject: %n%23%nUser mode my SHA thumbprint: %n%24%nUser mode impersonation: %25%n
0x377	IPSec user mode security association establishment failed.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nUser mode authentication method: %6%nUser mode peer subject: %n%7%nUser mode peer issuing certificate authority: %n%8%nUser mode peer root certificate authority: %n%9%nUser mode peer SHA thumbprint: %n%10%nUser mode my subject: %n%11%nUser mode my SHA thumbprint: %n%12%nFailure point: %13%nFailure reason: %14%nUser mode IKE state: %15%nInitiator or Responder: %16%nUser mode impersonation: %17%n	IPSec user mode security association establishment failed.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nUser mode authentication method: %6%nUser mode peer subject: %n%7%nUser mode peer issuing certificate authority: %n%8%nUser mode peer root certificate authority: %n%9%nUser mode peer SHA thumbprint: %n%10%nUser mode my subject: %n%11%nUser mode my SHA thumbprint: %n%12%nFailure point: %13%nFailure reason: %14%nUser mode IKE state: %15%nInitiator or Responder: %16%nUser mode impersonation: %17%n
0x378	IPSec user mode security association establishment failed.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nUser mode authentication method: %6%nUser mode my Id: %7%nUser mode peer Id: %8%nFailure point: %9%nFailure reason: %10%nUser mode IKE state: %11%nInitiator or Responder: %12%nUser mode impersonation: %13%n	IPSec user mode security association establishment failed.%nKeying module type: AuthIp%nLocal address: %1%nRemote address: %2%nLocal port: %3%nRemote port: %4%nPeer private address: %5%nUser mode authentication method: %6%nUser mode my Id: %7%nUser mode peer Id: %8%nFailure point: %9%nFailure reason: %10%nUser mode IKE state: %11%nInitiator or Responder: %12%nUser mode impersonation: %13%n
0x3A0	The Windows Firewall Service has successfully started.	The Windows Firewall Service has successfully started.
0x3A1	The Windows Firewall Service has been stopped.	The Windows Firewall Service has been stopped.
0x3A3	The Windows Firewall was unable to retrieve the security policy from the local storage. The Windows Firewall will continue enforcing the current enforced policy.%nError Code: %1	The Windows Firewall was unable to retrieve the security policy from the local storage. The Windows Firewall will continue enforcing the current enforced policy.%nError Code: %1
0x3A4	The Windows Firewall was unable to parse the new security policy. The Windows Firewall will continue with currently enforced policy.%nError Code: %1	The Windows Firewall was unable to parse the new security policy. The Windows Firewall will continue with currently enforced policy.%nError Code: %1
0x3A5	The Windows Firewall failed to initialize the driver. The Windows Firewall will continue to enforce current policy.%nError Code: %1	The Windows Firewall failed to initialize the driver. The Windows Firewall will continue to enforce current policy.%nError Code: %1
0x3A6	The Windows Firewall service failed to start.%nError Code: %1	The Windows Firewall service failed to start.%nError Code: %1
0x3A7	The Windows Firewall service found errors during shutdown.%nError Code: %1	The Windows Firewall service found errors during shutdown.%nError Code: %1
0x3A8	The Windows Firewall service found a critical runtime error. Terminating.%nError Code: %1	The Windows Firewall service found a critical runtime error. Terminating.%nError Code: %1
0x3A9	The Windows Firewall Driver has successfully started.	The Windows Firewall Driver has successfully started.
0x3AA	The Windows Firewall Driver has been stopped.	The Windows Firewall Driver has been stopped.
0x3AB	The Windows Firewall Driver failed to start.%nError Code: %1	The Windows Firewall Driver failed to start.%nError Code: %1
0x3AC	The Windows Firewall Driver found errors during shutdown.%nError Code: %1	The Windows Firewall Driver found errors during shutdown.%nError Code: %1
0x3AD	The Windows Firewall Driver found critical runtime error. Terminating.%nError Code: %1	The Windows Firewall Driver found critical runtime error. Terminating.%nError Code: %1
0x3B0	A change has been made to IPSec settings. An Authentication Set was added.%n%nProfile changed: %1%nAdded Authentication Set:%n Id: %2%n Name: %3	A change has been made to IPSec settings. An Authentication Set was added.%n%nProfile changed: %1%nAdded Authentication Set:%n Id: %2%n Name: %3
0x3B1	A change has been made to IPSec settings. An Authentication Set was modified.%n%nProfile changed: %1%nModified Authentication Set:%n Id: %2%n Name: %3	A change has been made to IPSec settings. An Authentication Set was modified.%n%nProfile changed: %1%nModified Authentication Set:%n Id: %2%n Name: %3
0x3B2	A change has been made to IPSec settings. An Authentication Set was deleted.%n%nProfile changed: %1%nDeleted Authentication Set:%n Id: %2%n Name: %3	A change has been made to IPSec settings. An Authentication Set was deleted.%n%nProfile changed: %1%nDeleted Authentication Set:%n Id: %2%n Name: %3
0x3B3	A change has been made to IPSec settings. A Connection Security Rule was added.%n%nProfile changed: %1%nAdded Connection Security Rule:%n Id: %2%n Name: %3	A change has been made to IPSec settings. A Connection Security Rule was added.%n%nProfile changed: %1%nAdded Connection Security Rule:%n Id: %2%n Name: %3
0x3B4	A change has been made to IPSec settings. A Connection Security Rule was modified.%n%nProfile changed: %1%nModified Connection Security Rule:%n Id: %2%n Name: %3	A change has been made to IPSec settings. A Connection Security Rule was modified.%n%nProfile changed: %1%nModified Connection Security Rule:%n Id: %2%n Name: %3
0x3B5	A change has been made to IPSec settings. A Connection Security Rule was deleted.%n%nProfile changed: %1%nDeleted Connection Security Rule:%n Id: %2%n Name: %3	A change has been made to IPSec settings. A Connection Security Rule was deleted.%n%nProfile changed: %1%nDeleted Connection Security Rule:%n Id: %2%n Name: %3
0x3B6	A change has been made to IPSec settings. A Crypto Set was added.%n%nProfile changed: %1%nAdded Crypto Set:%n Id: %2%n Name: %3	A change has been made to IPSec settings. A Crypto Set was added.%n%nProfile changed: %1%nAdded Crypto Set:%n Id: %2%n Name: %3
0x3B7	A change has been made to IPSec settings. A Crypto Set was modified.%n%nProfile changed: %1%nModified Crypto Set:%n Id: %2%n Name: %3	A change has been made to IPSec settings. A Crypto Set was modified.%n%nProfile changed: %1%nModified Crypto Set:%n Id: %2%n Name: %3
0x3B8	A change has been made to IPSec settings. A Crypto Set was deleted.%n%nProfile changed: %1%nDeleted Crypto Set:%n Id: %2%n Name: %3	A change has been made to IPSec settings. A Crypto Set was deleted.%n%nProfile changed: %1%nDeleted Crypto Set:%n Id: %2%n Name: %3
0x3B9	An IPSec Security Association was deleted.%n%nProfile changed: %1%nDeleted SA:%n Id: %2%n Name: %3	An IPSec Security Association was deleted.%n%nProfile changed: %1%nDeleted SA:%n Id: %2%n Name: %3
0x3BA	The IPSec policy was not updated because Active Directory Domain Services could not be reached.%n	The IPSec policy was not updated because Active Directory Domain Services could not be reached.%n
0x3D0	The following callout was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nCallout ID:%t%3%nCallout name:%t%4%nCallout type:%t%5%nCallout run-time ID:%t%6%nLayer ID:%t%7%nLayer name:%t%8%nLayer run-time ID:%t%9	The following callout was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nCallout ID:%t%3%nCallout name:%t%4%nCallout type:%t%5%nCallout run-time ID:%t%6%nLayer ID:%t%7%nLayer name:%t%8%nLayer run-time ID:%t%9
0x3D1	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nFilter ID:%t%3%nFilter name:%t%4%nFilter type:%t%5%nFilter run-time ID:%t%6%nLayer ID:%t%7%nLayer name:%t%8%nLayer run-time ID:%t%9%nWeight:%t%10%n%nConditions:%t%11%nFilter Action:%t%12%nCallout ID:%t%13%nCallout name:%t%14	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nFilter ID:%t%3%nFilter name:%t%4%nFilter type:%t%5%nFilter run-time ID:%t%6%nLayer ID:%t%7%nLayer name:%t%8%nLayer run-time ID:%t%9%nWeight:%t%10%n%nConditions:%t%11%nFilter Action:%t%12%nCallout ID:%t%13%nCallout name:%t%14
0x3D2	The following provider was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nProvider type:%t%3	The following provider was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nProvider type:%t%3
0x3D3	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nProvider context ID:%t%3%nProvider context name:%t%4%nProvider context type:%t%5	The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nProvider context ID:%t%3%nProvider context name:%t%4%nProvider context type:%t%5
0x3D4	The following sublayer was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nSublayer ID:%t%3%nSublayer name:%t%4%nSublayer type:%t%5%nWeight:%t%6	The following sublayer was present when the Windows Filtering Platform Base Filtering Engine started.%n%nProvider ID:%t%1%nProvider name:%t%2%nSublayer ID:%t%3%nSublayer name:%t%4%nSublayer type:%t%5%nWeight:%t%6
0x3D6	A Windows Filtering Platform callout has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nCallout ID:%t%7%nCallout name:%t%8%nCallout type:%t%9%nCallout run-time ID:%t%10%nLayer ID:%t%11%nLayer name:%t%12%nLayer run-time ID:%t%13	A Windows Filtering Platform callout has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nCallout ID:%t%7%nCallout name:%t%8%nCallout type:%t%9%nCallout run-time ID:%t%10%nLayer ID:%t%11%nLayer name:%t%12%nLayer run-time ID:%t%13
0x3D7	A Windows Filtering Platform filter has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nFilter ID:%t%7%nFilter name:%t%8%nFilter type:%t%9%nFilter run-time ID:%t%10%nLayer ID:%t%11%nLayer name:%t%12%nLayer run-time ID:%t%13%nWeight:%t%14%n%nConditions:%t%15%nFilter Action:%t%16%nCallout ID:%t%17%nCallout name:%t%18	A Windows Filtering Platform filter has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nFilter ID:%t%7%nFilter name:%t%8%nFilter type:%t%9%nFilter run-time ID:%t%10%nLayer ID:%t%11%nLayer name:%t%12%nLayer run-time ID:%t%13%nWeight:%t%14%n%nConditions:%t%15%nFilter Action:%t%16%nCallout ID:%t%17%nCallout name:%t%18
0x3D8	A Windows Filtering Platform provider has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nChange type:%t%4%nProvider ID:%t%5%nProvider name:%t%6%nProvider type:%t%7	A Windows Filtering Platform provider has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nChange type:%t%4%nProvider ID:%t%5%nProvider name:%t%6%nProvider type:%t%7
0x3D9	A Windows Filtering Platform provider context has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nProvider context ID:%t%7%nProvider context name:%t%8%nProvider context type:%t%9	A Windows Filtering Platform provider context has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nProvider context ID:%t%7%nProvider context name:%t%8%nProvider context type:%t%9
0x3DA	A Windows Filtering Platform sublayer has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nSublayer ID:%t%7%nSublayer name:%t%8%nSublayer type:%t%9%nWeight:%t%10	A Windows Filtering Platform sublayer has been changed.%n%nProcess ID:%t%1%nUser ID:%t%2%nUser name:%t%3%nProvider ID:%t%4%nProvider name:%t%5%nChange type:%t%6%nSublayer ID:%t%7%nSublayer name:%t%8%nSublayer type:%t%9%nWeight:%t%10
0x3E0	An IPsec Quick Mode security association was established.%n%nLocal address:%t%1%nLocal address mask:%t%2%nLocal port:%t%3%nLocal tunnel endpoint:%t%4%nRemote address:%t%5%nRemote address mask:%t%6%nRemote port:%t%7%nRemote private address:%t%8%nRemote tunnel endpoint:%t%9%nProtocol:%t%10%nKeying module name:%t%11%nIntegrity algorithm - AH:%t%12%nIntegrity algorithm - ESP:%t%13%nEncryption algorithm:%t%14%nLifetime - seconds:%t%15%nLifetime - data:%t%16%nLifetime - packets:%t%17%nMode:%t%18%nRole:%t%19%nQuick Mode filter identifier:%t%20%nMain Mode SA identifier:%t%21%nQuick Mode SA identifier:%t%22%nInbound SPI:%t%23%nOutbound SPI:%t%24	An IPsec Quick Mode security association was established.%n%nLocal address:%t%1%nLocal address mask:%t%2%nLocal port:%t%3%nLocal tunnel endpoint:%t%4%nRemote address:%t%5%nRemote address mask:%t%6%nRemote port:%t%7%nRemote private address:%t%8%nRemote tunnel endpoint:%t%9%nProtocol:%t%10%nKeying module name:%t%11%nIntegrity algorithm - AH:%t%12%nIntegrity algorithm - ESP:%t%13%nEncryption algorithm:%t%14%nLifetime - seconds:%t%15%nLifetime - data:%t%16%nLifetime - packets:%t%17%nMode:%t%18%nRole:%t%19%nQuick Mode filter identifier:%t%20%nMain Mode SA identifier:%t%21%nQuick Mode SA identifier:%t%22%nInbound SPI:%t%23%nOutbound SPI:%t%24
0x3E1	An IPsec Quick Mode security association ended.%n%nLocal address:%t%1%nLocal port:%t%2%nLocal tunnel endpoint:%t%3%nRemote address:%t%4%nRemote port:%t%5%nRemote tunnel endpoint:%t%6%nProtocol:%t%7%nQuick Mode SA identifier:%t%8	An IPsec Quick Mode security association ended.%n%nLocal address:%t%1%nLocal port:%t%2%nLocal tunnel endpoint:%t%3%nRemote address:%t%4%nRemote port:%t%5%nRemote tunnel endpoint:%t%6%nProtocol:%t%7%nQuick Mode SA identifier:%t%8
0x3E2	An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.	An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.
0x400	OCSP Responder Service Started.	OCSP Responder Service Started.
0x401	OCSP Responder Service Stopped.	OCSP Responder Service Stopped.
0x402	A Configuration entry changed in OCSP Responder Service.%nCA Configuration ID: %t%1%nNew Value: %t%2%n	A Configuration entry changed in OCSP Responder Service.%nCA Configuration ID: %t%1%nNew Value: %t%2%n
0x403	A Configuration entry changed in OCSP Responder Service.%nPropertyName: %t%1%nNew Value: %t%2%n	A Configuration entry changed in OCSP Responder Service.%nPropertyName: %t%1%nNew Value: %t%2%n
0x404	Security setting is updated on OCSP Responder Service.%nNew Value:%t%1%n	Security setting is updated on OCSP Responder Service.%nNew Value:%t%1%n
0x405	A request is submitted to OCSP Responder Service.%n	A request is submitted to OCSP Responder Service.%n
0x406	Signing Certificate is automatically updated by OCSP Responder Service.%nCA Configuration ID: %t%1%nNew Signing Certificate Hash: %t%2%n	Signing Certificate is automatically updated by OCSP Responder Service.%nCA Configuration ID: %t%1%nNew Signing Certificate Hash: %t%2%n
0x407	OCSP Revocation Provider successfully updated the revocation information.%nCA Configuration ID: %t%1%nBase CRL Number: %t%2%nBase CRL This Update: %t%3%nBase CRL Hash: %t%4%nDelta CRL Number: %t%5%nDelta CRL Indicator: %t%6%nDelta CRL This Update: %t%7%nDelta CRL Hash: %t%8%n	OCSP Revocation Provider successfully updated the revocation information.%nCA Configuration ID: %t%1%nBase CRL Number: %t%2%nBase CRL This Update: %t%3%nBase CRL Hash: %t%4%nDelta CRL Number: %t%5%nDelta CRL Indicator: %t%6%nDelta CRL This Update: %t%7%nDelta CRL Hash: %t%8%n
0xFFF	Highest System-Defined Audit Message Value.	Highest System-Defined Audit Message Value.

File Name:	msaudite.dll.mui
Directory:	%WINDIR%\WinSxS\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.15063.0_en-us_6b197d2c92ab2035\
File Size:	152 kB
File Permissions:	rw-rw-rw-
File Type:	Win32 DLL
File Type Extension:	dll
MIME Type:	application/octet-stream
Machine Type:	Intel 386 or later, and compatibles
Time Stamp:	0000:00:00 00:00:00
PE Type:	PE32
Linker Version:	14.10
Code Size:	0
Initialized Data Size:	154624
Uninitialized Data Size:	0
Entry Point:	0x0000
OS Version:	10.0
Image Version:	10.0
Subsystem Version:	6.0
Subsystem:	Windows GUI
File Version Number:	10.0.15063.0
Product Version Number:	10.0.15063.0
File Flags Mask:	0x003f
File Flags:	(none)
File OS:	Windows NT 32-bit
Object File Type:	Dynamic link library
File Subtype:	0
Language Code:	English (U.S.)
Character Set:	Unicode
Company Name:	Microsoft Corporation
File Description:	Security Audit Events DLL
File Version:	10.0.15063.0 (WinBuild.160101.0800)
Internal Name:	msaudite.dll
Legal Copyright:	© Microsoft Corporation. All rights reserved.
Original File Name:	msaudite.dll.mui
Product Name:	Microsoft® Windows® Operating System
Product Version:	10.0.15063.0
Directory:	%WINDIR%\WinSxS\wow64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.15063.0_en-us_756e277ec70be230\

msaudite.dll.mui is Multilingual User Interface resource file that contain English (U.S.) language for file msaudite.dll (Security Audit Events DLL).

File Description:	Security Audit Events DLL
File Version:	10.0.15063.0 (WinBuild.160101.0800)
Company Name:	Microsoft Corporation
Internal Name:	msaudite.dll
Legal Copyright:	© Microsoft Corporation. All rights reserved.
Original Filename:	msaudite.dll.mui
Product Name:	Microsoft® Windows® Operating System
Product Version:	10.0.15063.0
Translation:	0x409, 1200