Microsoft-Windows-Security-LessPrivilegedAppContainer

1 events across 1 channel

Event ID	Title	Channel
1	Access to the a resource has been denied for a less privileged app container at …	Operational

Event ID 1 — Access to the a resource has been denied for a less privileged app container at FailureTime (StackHash: StackHash).

Provider: Microsoft-Windows-Security-LessPrivilegedAppContainer
Channel: Operational
Level: Error
Task: AccessFailure

Description

Access to the a resource has been denied for a less privileged app container at FailureTime (StackHash: StackHash).

Message #

Access to the a resource has been denied for a less privileged app container at %1 (StackHash: %2).

Fields #

Name	Description
`FailureTime` FILETIME	—
`StackHash` HexInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-LessPrivilegedAppContainer",
    "guid": "45EEC9E5-4A1B-5446-7AD8-A4AB1313C437",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:27:47.906139+00:00",
    "event_record_id": 166,
    "correlation": {},
    "execution": {
      "process_id": 6084,
      "thread_id": 6236
    },
    "channel": "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "FailureTime": "2026-03-11T06:27:47.906118Z",
    "StackHash": "0xaf5279f2"
  },
  "message": ""
}