detection.wiki

Microsoft-Windows-GroupPolicy › Event 4004

Event ID 4004 — Starting manual processing of policy for computer PrincipalSamName.

Provider
Microsoft-Windows-GroupPolicy
Channel
Operational
Level
Informational
Opcode
Start

Description

Starting manual processing of policy for computer PrincipalSamName.

Message #

Starting manual processing of policy for computer %2. 
Activity id: %1

Fields #

NameDescription
PolicyActivityId GUIDActivity id.
PrincipalSamName UnicodeStringSAM name of the computer account for which GPO processing was started
IsMachine UInt32—
IsDomainJoined Boolean—
IsBackgroundProcessing Boolean—
IsAsyncProcessing Boolean—
IsServiceRestart Boolean—
ReasonForSyncProcessing UInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 4004,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-05T23:49:57.126023+00:00",
    "event_record_id": 1152,
    "correlation": {
      "ActivityID": "AA63BEC0-3996-4133-A97D-DB5DB9617FF3"
    },
    "execution": {
      "process_id": 8540,
      "thread_id": 9876
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "AA63BEC0-3996-4133-A97D-DB5DB9617FF3",
    "PrincipalSamName": "WORKGROUP\\WINDEV2310EVAL$",
    "IsMachine": 1,
    "IsDomainJoined": false,
    "IsBackgroundProcessing": true,
    "IsAsyncProcessing": false,
    "IsServiceRestart": false,
    "ReasonForSyncProcessing": 0
  },
  "message": ""
}

References #