deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-07 18:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Put missing linebrks back in Event XML

Browse Source
This commit is contained in:
JanKeller1 2016-06-01 15:36:48 -07:00
parent 7157f6770f
commit 6ea04c9192
1 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
windows/keep-secure/event-4769.md
View File

@ -35,8 +35,37 @@ You will typically see many Failure events with **Failure Code** “**0x20**”,
***Event XML:***
```
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">- <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4769</EventID> <Version>0</Version> <Level>0</Level> <Task>14337</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2015-08-07T18:13:46.043256100Z" /> <EventRecordID>166746</EventRecordID> <Correlation /> <Execution ProcessID="520" ThreadID="1496" /> <Channel>Security</Channel> <Computer>DC01.contoso.local</Computer> <Security /> </System>- <EventData> <Data Name="TargetUserName">dadmin@CONTOSO.LOCAL</Data> <Data Name="TargetDomainName">CONTOSO.LOCAL</Data> <Data Name="ServiceName">WIN2008R2$</Data> <Data Name="ServiceSid">S-1-5-21-3457937927-2839227994-823803824-2102</Data> <Data Name="TicketOptions">0x40810000</Data> <Data Name="TicketEncryptionType">0x12</Data> <Data Name="IpAddress">::ffff:10.0.0.12</Data> <Data Name="IpPort">49272</Data> <Data Name="Status">0x0</Data> <Data Name="LogonGuid">{F85C455E-C66E-205C-6B39-F6C60A7FE453}</Data> <Data Name="TransmittedServices">-</Data> </EventData> </Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4769</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>14337</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-08-07T18:13:46.043256100Z" />
<EventRecordID>166746</EventRecordID>
<Correlation />
<Execution ProcessID="520" ThreadID="1496" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserName">dadmin@CONTOSO.LOCAL</Data>
<Data Name="TargetDomainName">CONTOSO.LOCAL</Data>
<Data Name="ServiceName">WIN2008R2$</Data>
<Data Name="ServiceSid">S-1-5-21-3457937927-2839227994-823803824-2102</Data>
<Data Name="TicketOptions">0x40810000</Data>
<Data Name="TicketEncryptionType">0x12</Data>
<Data Name="IpAddress">::ffff:10.0.0.12</Data>
<Data Name="IpPort">49272</Data>
<Data Name="Status">0x0</Data>
<Data Name="LogonGuid">{F85C455E-C66E-205C-6B39-F6C60A7FE453}</Data>
<Data Name="TransmittedServices">-</Data>
</EventData>
</Event>
```
***Required Server Roles:*** Active Directory domain controller.