detection.wiki

Microsoft-Windows-GroupPolicy › Event 1501

Event ID 1501 — The Group Policy settings for the user were processed successfully.

Provider
Microsoft-Windows-GroupPolicy
Channel
System
Level
Informational
Opcode
Start

Description

The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy.

Message #

The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy.

Fields #

NameDescription
SupportInfo1 UInt32—
SupportInfo2 UInt32—
ProcessingMode UInt32—
ProcessingTimeInMilliseconds UInt32—
DCName UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 1501,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:28:54.475787+00:00",
    "event_record_id": 1832,
    "correlation": {
      "ActivityID": "5D6D5E8D-CE04-46CB-BF83-231A8B295C46"
    },
    "execution": {
      "process_id": 1860,
      "thread_id": 4880
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SupportInfo1": 1,
    "SupportInfo2": 4214,
    "ProcessingMode": 1,
    "ProcessingTimeInMilliseconds": 734,
    "DCName": ""
  },
  "message": ""
}

References #