detection.wiki

Microsoft-Windows-AuthenticationProvider

2 events across 1 channel

Event IDTitleChannel
101The security package does not cache the credentials needed to authenticate to …ProtectedUser-Client
304The security package does not cache the user's sign on credentials.ProtectedUser-Client

Event ID 101 — The security package does not cache the credentials needed to authenticate to the server.

Provider
Microsoft-Windows-AuthenticationProvider
Channel
ProtectedUser-Client

Description

The security package does not cache the credentials needed to authenticate to the server.

Message #

The security package does not cache the credentials needed to authenticate to the server.

Package Name: %1
User Name: %2
Domain Name: %3
Server Name: %4
Protected User: %5
Error Code: %6

Fields #

NameDescription
Package_Name UnicodeString—
User_Name UnicodeString—
Domain_Name UnicodeString—
Server_Name UnicodeString—
Protected_User UInt32—
Error_Code HexInt32—
PackageName UnicodeString—
UserName UnicodeString—
DomainName UnicodeString—
ServerName UnicodeString—
ProtectedUser UInt32—
ErrorCode HexInt32—

Event ID 304 — The security package does not cache the user's sign on credentials.

Provider
Microsoft-Windows-AuthenticationProvider
Channel
ProtectedUser-Client

Description

The security package does not cache the user's sign on credentials.

Message #

The security package does not cache the user's sign on credentials.

Package Name: %1
User Name: %2
Domain Name: %3
Protected User: %4

Fields #

NameDescription
Package_Name UnicodeString—
User_Name UnicodeString—
Domain_Name UnicodeString—
Protected_User UInt32—
PackageName UnicodeString—
UserName UnicodeString—
DomainName UnicodeString—
ProtectedUser UInt32—