detection.wiki

Microsoft-Windows-GroupPolicy › Event 4000

Event ID 4000 — Starting computer boot policy processing for PrincipalSamName.

Provider
Microsoft-Windows-GroupPolicy
Channel
Operational
Level
Informational
Opcode
Start

Description

Starting computer boot policy processing for PrincipalSamName.

Message #

Starting computer boot policy processing for %2. 
Activity id: %1

Fields #

NameDescription
PolicyActivityId GUIDActivity id.
PrincipalSamName UnicodeStringSAM name of the computer account for which GPO processing was started
IsMachine UInt32—
IsDomainJoined Boolean—
IsBackgroundProcessing Boolean—
IsAsyncProcessing Boolean—
IsServiceRestart Boolean—
ReasonForSyncProcessing UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 4000,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-05T22:32:17.280621+00:00",
    "event_record_id": 479,
    "correlation": {
      "ActivityID": "70C9A908-A206-406D-8A5D-D1CA7FEE9E13"
    },
    "execution": {
      "process_id": 1132,
      "thread_id": 1348
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "70C9A908-A206-406D-8A5D-D1CA7FEE9E13",
    "PrincipalSamName": "WORKGROUP\\WINDEV2310EVAL$",
    "IsMachine": 1,
    "IsDomainJoined": false,
    "IsBackgroundProcessing": false,
    "IsAsyncProcessing": true,
    "IsServiceRestart": false,
    "ReasonForSyncProcessing": 0
  },
  "message": ""
}

References #