detection.wiki

Microsoft-Windows-Security-EnterpriseData-FileRevocationManager

6 events across 1 channel

Event IDTitleChannel
0Application AppIDString created an enterprise protection key for EntIDString.Operational
1Application AppIDString failed to create an enterprise protection key for …Operational
17Application AppIDString successfully deleted all EntIDString enterprise …Operational
18Application AppIDString successfully deleted its EntIDString enterprise …Operational
19Application AppIDString failed to delete EntIDString enterprise protection …Operational
20The following entry in the Group Policy "Allow Windows Runtime apps to revoke …Operational

Event ID 0 — Application AppIDString created an enterprise protection key for EntIDString.

Provider
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Channel
Operational
Opcode
ProtectIdentityoperation.

Description

Application AppIDString created an enterprise protection key for EntIDString.

Message #

Application %2 created an enterprise protection key for %1.

Fields #

NameDescription
EntIDString UnicodeString—
AppIDString UnicodeString—

Event ID 1 — Application AppIDString failed to create an enterprise protection key for EntIDString.

Provider
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Channel
Operational
Opcode
ProtectIdentityoperation.

Description

Application AppIDString failed to create an enterprise protection key for EntIDString. Error: ErrorCode.

Message #

Application %2 failed to create an enterprise protection key for %1. Error: %3.

Fields #

NameDescription
EntIDString UnicodeString—
AppIDString UnicodeString—
ErrorCode HexInt32—

Event ID 17 — Application AppIDString successfully deleted all EntIDString enterprise protection keys.

Provider
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Channel
Operational
Opcode
RevokeIdentityoperation.

Description

Application AppIDString successfully deleted all EntIDString enterprise protection keys.

Message #

Application %2 successfully deleted all %1 enterprise protection keys.

Fields #

NameDescription
EntIDString UnicodeString—
AppIDString UnicodeString—

Event ID 18 — Application AppIDString successfully deleted its EntIDString enterprise protection key.

Provider
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Channel
Operational
Opcode
RevokeIdentityoperation.

Description

Application AppIDString successfully deleted its EntIDString enterprise protection key.

Message #

Application %2 successfully deleted its %1 enterprise protection key.

Fields #

NameDescription
EntIDString UnicodeString—
AppIDString UnicodeString—

Event ID 19 — Application AppIDString failed to delete EntIDString enterprise protection key(s).

Provider
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Channel
Operational
Opcode
RevokeIdentityoperation.

Description

Application AppIDString failed to delete EntIDString enterprise protection key(s). Error: ErrorCode.

Message #

Application %2 failed to delete %1 enterprise protection key(s). Error: %3.

Fields #

NameDescription
EntIDString UnicodeString—
AppIDString UnicodeString—
ErrorCode HexInt32—

Event ID 20 — The following entry in the Group Policy "Allow Windows Runtime apps to revoke enterprise data" is formatted incorrectly and was ignored.

Provider
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager
Channel
Operational
Opcode
Delegationoperation.

Description

The following entry in the Group Policy "Allow Windows Runtime apps to revoke enterprise data" is formatted incorrectly and was ignored.

Message #

The following entry in the Group Policy "Allow Windows Runtime apps to revoke enterprise data" is formatted incorrectly and was ignored:
%1

Fields #

NameDescription
PolicyString UnicodeString—