deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-29 13:47:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #8189 from suajose/suajose-patch-1

Browse Source 
Suajose Event 4698 - Event new properties
This commit is contained in:
Daniel Simpson 2020-09-11 08:34:29 -07:00 committed by GitHub
commit 0e17a9719b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
windows/security/threat-protection/auditing/event-4698.md
View File

@ -62,6 +62,17 @@ This event generates every time a new scheduled task is created.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4699.md
View File

@ -62,6 +62,17 @@ This event generates every time a scheduled task was deleted.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4700.md
View File

@ -62,6 +62,17 @@ This event generates every time a scheduled task is enabled.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4701.md
View File

@ -62,6 +62,17 @@ This event generates every time a scheduled task is disabled.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4702.md
View File

@ -62,6 +62,17 @@ This event generates every time scheduled task was updated/changed.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.