Microsoft-Windows-ParentalControls

21 events across 1 channel

Event ID	Title	Channel
1	A Setting changed inside of the parental controls settings	Operational
2	Generated when a game is run	Operational
3	Generated when a URL is visited	Operational
4	Generated with an Email is Received	Operational
5	Generated with an Email is Sent	Operational
6	Generated when some media is played	Operational
7	Generated when an IM Invitiation is sent	Operational
8	Generated when a user Joins an IM conversation	Operational
9	Generated when a user leaves an IM conversation	Operational
10	Generated when a user downloads a file	Operational
11	Generated when one of the IM features is used, like web chat, audio	Operational
13	Generated by external apps that want to log parental control information	Operational
14	Generated when an email contact is changed	Operational
15	Generated when an IM contact is changed	Operational
16	Generated when an application is blocked from running	Operational
17	Generated when an application override is requested	Operational
18	Generated when a url override is requested	Operational
19	Generated when a website is visited	Operational
20	Generated when an application is started, stopped or blocked	Operational
21	Generated when the computer is used	Operational
22	Generated when content is used or blocked	Operational

Event ID 1 — A Setting changed inside of the parental controls settings

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: SettingChange
Opcode: Modify

Description

A Setting changed inside of the parental controls settings.

Message #

A Setting changed inside of the parental controls settings

Fields #

Name	Description
`Class` UnicodeString	—
`Setting` UInt32	—
`AccountOwner` UnicodeString	—
`OldValue` UnicodeString	—
`NewValue` UnicodeString	—
`Reason` UInt32	—
`Optional` UnicodeString	—

Event ID 2 — Generated when a game is run

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: GameStart
Opcode: Launch

Description

Generated when a game is run.

Message #

Generated when a game is run

Fields #

Name	Description
`AppID` GUID	—
`InstanceID` GUID	—
`Version` UnicodeString	—
`Path` UnicodeString	—
`Rating` UnicodeString	—
`RatingsSystem` GUID	—
`Reason` UInt32	—
`DescriptorCount` UInt32	—
`Descriptor` UnicodeString	—
`PID` UInt32	—

Event ID 3 — Generated when a URL is visited

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: UrlVisit
Opcode: Web

Description

Generated when a URL is visited.

Message #

Generated when a URL is visited

Fields #

Name	Description
`URL` UnicodeString	—
`Application` UnicodeString	—
`Version` UnicodeString	—
`Reason` UInt32	—
`RatingSystemID` GUID	—
`CategoryCount` UInt32	—
`Category` UnicodeString	—

Event ID 4 — Generated with an Email is Received

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: EmailReceived
Opcode: Launch

Description

Generated with an Email is Received.

Message #

Generated with an Email is Received

Fields #

Name	Description
`Sender` UnicodeString	—
`Application` UnicodeString	—
`Version` UnicodeString	—
`Subject` UnicodeString	—
`Reason` UInt32	—
`RecipientCount` UInt32	—
`Recipient` UnicodeString	—
`AttachmentCount` UInt32	—
`AttachmentName` UnicodeString	—
`ReceivedTime` SYSTEMTIME	—
`EmailAccount` UnicodeString	—

Event ID 5 — Generated with an Email is Sent

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: EmailSent
Opcode: Launch

Description

Generated with an Email is Sent.

Message #

Generated with an Email is Sent

Fields #

Name	Description
`Sender` UnicodeString	—
`Application` UnicodeString	—
`Version` UnicodeString	—
`Subject` UnicodeString	—
`Reason` UInt32	—
`RecipientCount` UInt32	—
`Recipient` UnicodeString	—
`AttachmentCount` UInt32	—
`AttachmentName` UnicodeString	—
`EmailAccount` UnicodeString	—

Event ID 6 — Generated when some media is played

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: MediaPlayback
Opcode: Launch

Description

Generated when some media is played.

Message #

Generated when some media is played

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`MediaType` UInt32	—
`Path` UnicodeString	—
`Title` UnicodeString	—
`PML` UInt32	—
`Album` UnicodeString	—
`ExplicitContent` UInt32	—
`Reason` UInt32	—

Event ID 7 — Generated when an IM Invitiation is sent

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: IMInvitation
Opcode: Launch

Description

Generated when an IM Invitiation is sent.

Message #

Generated when an IM Invitiation is sent

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`AccountName` UnicodeString	—
`ConversationID` UnicodeString	—
`RequestingIP` UnicodeString	—
`Sender` UnicodeString	—
`Reason` UInt32	—
`RecipientCount` UInt32	—
`Recipient` UnicodeString	—

Event ID 8 — Generated when a user Joins an IM conversation

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: IMJoin
Opcode: Launch

Description

Generated when a user Joins an IM conversation.

Message #

Generated when a user Joins an IM conversation

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`AccountName` UnicodeString	—
`ConversationID` UnicodeString	—
`JoiningIP` UnicodeString	—
`JoiningUser` UnicodeString	—
`Reason` UInt32	—
`MemberCount` UInt32	—
`Member` UnicodeString	—
`Sender` UnicodeString	—

Event ID 9 — Generated when a user leaves an IM conversation

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: IMLeave
Opcode: Launch

Description

Generated when a user leaves an IM conversation.

Message #

Generated when a user leaves an IM conversation

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`AccountName` UnicodeString	—
`ConversationID` UnicodeString	—
`LeavingIP` UnicodeString	—
`LeavingUser` UnicodeString	—
`Reason` UInt32	—
`MemberCount` UInt32	—
`Member` UnicodeString	—
`Flags` UInt32	—

Event ID 10 — Generated when a user downloads a file

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: FileDownload
Opcode: Web

Description

Generated when a user downloads a file.

Message #

Generated when a user downloads a file

Fields #

Name	Description
`URL` UnicodeString	—
`Application` UnicodeString	—
`Version` UnicodeString	—
`Reason` UInt32	—
`Path` UnicodeString	—

Event ID 11 — Generated when one of the IM features is used, like web chat, audio

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: IMFeature
Opcode: Launch

Description

Generated when one of the IM features is used, like web chat, audio.

Message #

Generated when one of the IM features is used, like web chat, audio

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`AccountName` UnicodeString	—
`ConversationID` UnicodeString	—
`MediaType` UInt32	—
`Reason` UInt32	—
`RecipientCount` UInt32	—
`Recipient` UnicodeString	—
`Sender` UnicodeString	—
`SenderIP` UnicodeString	—
`Data` UnicodeString	—

Event ID 13 — Generated by external apps that want to log parental control information

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: Custom
Opcode: System

Description

Generated by external apps that want to log parental control information.

Message #

Generated by external apps that want to log parental control information

Fields #

Name	Description
`Publisher` UnicodeString	—
`Application` UnicodeString	—
`Version` UnicodeString	—
`Event` UnicodeString	—
`Value1` UnicodeString	—
`Value2` UnicodeString	—
`Value3` UnicodeString	—
`Blocked` UInt32	—
`Reason` UnicodeString	—

Event ID 14 — Generated when an email contact is changed

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: EmailContact
Opcode: Launch

Description

Generated when an email contact is changed.

Message #

Generated when an email contact is changed

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`OldName` UnicodeString	—
`OldAddress` UnicodeString	—
`NewName` UnicodeString	—
`NewAddress` UnicodeString	—
`Reason` UInt32	—
`EmailAccount` UnicodeString	—

Event ID 15 — Generated when an IM contact is changed

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: IMContact
Opcode: Launch

Description

Generated when an IM contact is changed.

Message #

Generated when an IM contact is changed

Fields #

Name	Description
`Application` UnicodeString	—
`Version` UnicodeString	—
`AccountName` UnicodeString	—
`OldName` UnicodeString	—
`OldID` UnicodeString	—
`NewName` UnicodeString	—
`NewID` UnicodeString	—
`Reason` UInt32	—

Event ID 16 — Generated when an application is blocked from running

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: ApplicationBlocked
Opcode: Launch

Description

Generated when an application is blocked from running.

Message #

Generated when an application is blocked from running

Fields #

Name	Description
`Timestamp` SYSTEMTIME	—
`UserID` UnicodeString	—
`Path` UnicodeString	—
`RuleID` UnicodeString	—

Event ID 17 — Generated when an application override is requested

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: ApplicationOverride
Opcode: Launch

Description

Generated when an application override is requested.

Message #

Generated when an application override is requested

Fields #

Name	Description
`UserID` UnicodeString	—
`Path` UnicodeString	—
`Reason` UInt32	—

Event ID 18 — Generated when a url override is requested

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: WebOverride
Opcode: Launch

Description

Generated when a url override is requested.

Message #

Generated when a url override is requested

Fields #

Name	Description
`UserID` UnicodeString	—
`URL` UnicodeString	—
`Reason` UInt32	—

Event ID 19 — Generated when a website is visited

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: WebsiteVisit
Opcode: Web

Description

Generated when a website is visited.

Message #

Generated when a website is visited

Fields #

Name	Description
`Url` UnicodeString	—
`Decision` UInt32	—
`Categories` UnicodeString	—
`BlockedCategories` UnicodeString	—
`SerializedApplication` UnicodeString	—
`Title` UnicodeString	—
`ContentType` UnicodeString	—
`Referrer` UnicodeString	—
`Telemetry` UnicodeString	—

Event ID 20 — Generated when an application is started, stopped or blocked

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: Application
Opcode: Launch

Description

Generated when an application is started, stopped or blocked.

Message #

Generated when an application is started, stopped or blocked

Fields #

Name	Description
`SerializedApplication` UnicodeString	—
`State` UInt32	—
`ProcessId` UInt32	—
`CreationTime` FILETIME	—
`TimeUsed` UInt64	—

Event ID 21 — Generated when the computer is used

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: ComputerUsage
Opcode: System

Description

Generated when the computer is used.

Message #

Generated when the computer is used

Fields #

Name	Description
`Id` UInt64	—
`TimeUsed` UInt64	—

Event ID 22 — Generated when content is used or blocked

Provider: Microsoft-Windows-ParentalControls
Channel: Operational
Task: ContentUsage
Opcode: System

Description

Generated when content is used or blocked.

Message #

Generated when content is used or blocked

Fields #

Name	Description
`ContentProviderId` UnicodeString	—
`ContentProviderTitle` UnicodeString	—
`Id` UnicodeString	—
`Title` UnicodeString	—
`Category` UInt32	—
`Ratings` UnicodeString	—
`Decision` UInt32	—