deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-22 05:43:41 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

updating Events

Browse Source 
Updation changes to events 4699. 4700 and more
This commit is contained in:
Jose Sua
2020-08-31 17:24:32 -07:00
parent f64cd95a46
commit 7d40b987e2
4 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
windows/security/threat-protection/auditing/event-4699.md
View File

@ -62,6 +62,17 @@ This event generates every time a scheduled task was deleted.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4700.md
View File

@ -62,6 +62,17 @@ This event generates every time a scheduled task is enabled.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4701.md
View File

@ -62,6 +62,17 @@ This event generates every time a scheduled task is disabled.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.

11
windows/security/threat-protection/auditing/event-4702.md
View File

@ -62,6 +62,17 @@ This event generates every time scheduled task was updated/changed.
</Event>
```
>[!NOTE]
> Windows 10 Versions 1903 and above augments the event with these additional properties:
> Event Version 1.
> ***Event XML:***
>```
> <Data Name="ClientProcessStartKey">5066549580796854</Data>
> <Data Name="ClientProcessId">3932</Data>
> <Data Name="ParentProcessId">5304</Data>
> <Data Name="RpcCallClientLocality">0</Data>
> <Data Name="FQDN">DESKTOP-Name</Data>
***Required Server Roles:*** None.