MacriumImageGuardian

16 events across 1 channel

Event ID	Title	Channel
3	Blocked unauthorised process (processName) from deleting file (fileName).	Unknown
4	Blocked unauthorised process (processName) from renaming file (fileName).	Unknown
5	Blocked unauthorised process (processName) accessing file (fileName).	Unknown
90	MIG protection enabled	Unknown
91	MIG protection disabled	Unknown
92	MIG protection disabled until the next reboot	Unknown
100	Driver Loaded version.	Unknown
200	Driver Unloaded	Unknown
320	Blocked unauthorised process (processName) accessing file (fileName).	Unknown
330	User has enabled Image Guardian on volume (volumePath).	Unknown
340	User has disabled Image Guardian on volume (volumePath).	Unknown
510	Error protecting volume (volumePath).	Unknown
520	Error unprotecting volume (volumePath).	Unknown
600	Attribute error sourceFile sourceLine.	Unknown
601	A cryptographic function failed with status status.	Unknown
602	Blocked Operation Stack Trace:stackBackTrace.	Unknown

Event ID 3 — Blocked unauthorised process (processName) from deleting file (fileName).

Provider: MacriumImageGuardian
Channel: Unknown

Description

Blocked unauthorised process (processName) from deleting file (fileName).

Message #

Blocked unauthorised process (%1) from deleting file (%2)

Fields #

Name	Description
`processName` UnicodeString	—
`fileName` UnicodeString	—

Event ID 4 — Blocked unauthorised process (processName) from renaming file (fileName).

Provider: MacriumImageGuardian
Channel: Unknown

Description

Blocked unauthorised process (processName) from renaming file (fileName).

Message #

Blocked unauthorised process (%1) from renaming file (%2)

Fields #

Name	Description
`processName` UnicodeString	—
`fileName` UnicodeString	—

Event ID 5 — Blocked unauthorised process (processName) accessing file (fileName).

Provider: MacriumImageGuardian
Channel: Unknown

Description

Blocked unauthorised process (processName) accessing file (fileName). The thread starting address could not be verified.

Message #

Blocked unauthorised process (%1) accessing file (%2). The thread starting address could not be verified.

Fields #

Name	Description
`processName` UnicodeString	—
`fileName` UnicodeString	—

Event ID 90 — MIG protection enabled

Provider: MacriumImageGuardian
Channel: Unknown

Description

MIG protection enabled.

Message #

MIG protection enabled

Event ID 91 — MIG protection disabled

Provider: MacriumImageGuardian
Channel: Unknown

Description

MIG protection disabled.

Message #

MIG protection disabled

Event ID 92 — MIG protection disabled until the next reboot

Provider: MacriumImageGuardian
Channel: Unknown

Description

MIG protection disabled until the next reboot.

Message #

MIG protection disabled until the next reboot

Event ID 100 — Driver Loaded version.

Provider: MacriumImageGuardian
Channel: Unknown

Description

Driver Loaded version.

Message #

Driver Loaded %1

Fields #

Name	Description
`version` AnsiString	—

Event ID 200 — Driver Unloaded

Provider: MacriumImageGuardian
Channel: Unknown

Description

Driver Unloaded.

Message #

Driver Unloaded

Event ID 320 — Blocked unauthorised process (processName) accessing file (fileName).

Provider: MacriumImageGuardian
Channel: Unknown

Description

Blocked unauthorised process (processName) accessing file (fileName).

Message #

Blocked unauthorised process (%1) accessing file (%2)

Fields #

Name	Description
`processName` UnicodeString	—
`fileName` UnicodeString	—

Event ID 330 — User has enabled Image Guardian on volume (volumePath).

Provider: MacriumImageGuardian
Channel: Unknown

Description

User has enabled Image Guardian on volume (volumePath).

Message #

User has enabled Image Guardian on volume (%1)

Fields #

Name	Description
`volumePath` UnicodeString	—

Event ID 340 — User has disabled Image Guardian on volume (volumePath).

Provider: MacriumImageGuardian
Channel: Unknown

Description

User has disabled Image Guardian on volume (volumePath).

Message #

User has disabled Image Guardian on volume (%1).

Fields #

Name	Description
`volumePath` UnicodeString	—

Event ID 510 — Error protecting volume (volumePath).

Provider: MacriumImageGuardian
Channel: Unknown

Description

Error protecting volume (volumePath). Error code = errorCode.

Message #

Error protecting volume (%1). Error code = %2

Fields #

Name	Description
`volumePath` UnicodeString	—
`errorCode` UInt32	—

Event ID 520 — Error unprotecting volume (volumePath).

Provider: MacriumImageGuardian
Channel: Unknown

Description

Error unprotecting volume (volumePath). Error code = errorCode.

Message #

Error unprotecting volume (%1). Error code = %2.

Fields #

Name	Description
`volumePath` UnicodeString	—
`errorCode` UInt32	—

Event ID 600 — Attribute error sourceFile sourceLine.

Provider: MacriumImageGuardian
Channel: Unknown

Description

Attribute error sourceFile sourceLine.

Message #

Attribute error %1 %2

Fields #

Name	Description
`sourceFile` AnsiString	—
`sourceLine` UInt32	—

Event ID 601 — A cryptographic function failed with status status.

Provider: MacriumImageGuardian
Channel: Unknown

Description

A cryptographic function failed with status status.

Message #

A cryptographic function failed with status %1

Fields #

Name	Description
`status` UInt32	— NTSTATUS reference
`sourceFile` AnsiString	—
`sourceLine` UInt32	—

Event ID 602 — Blocked Operation Stack Trace:stackBackTrace.

Provider: MacriumImageGuardian
Channel: Unknown

Description

Blocked Operation Stack Trace:stackBackTrace.

Message #

Blocked Operation Stack Trace:%1

Fields #

Name	Description
`stackBackTrace` AnsiString	—