Eventlog %% value

Question

Hello! I try to create normalization rule for SIEM-system from Windows Event xml. Event 4738 "A user account was changed".

Example -----------------------------------

<Data Name="AccountExpires">%%1794</Data>
<Data Name="PrimaryGroupId">513</Data>
<Data Name="AllowedToDelegateTo">-</Data>
<Data Name="OldUacValue">0x10</Data>
<Data Name="NewUacValue">0x210</Data>
<Data Name="UserAccountControl">
    %%2089</Data>
<Data Name="UserParameters">%%1793</Data>
<Data Name="SidHistory">-</Data>
<Data Name="LogonHours">%%1797</Data>

---

Where can I see the values of %%**** and their descriptions?

Like: %%2089 - Password never expired (Enabled), etc.

I want all possible values that can appear in Winevent 4738.

Thank you!

Answer 1

Thank you for all!

I foud my answer in book Windows security monitoring: Scenarios and patterns (Andrei Miroshnikov).
Not for advertising, but this is the only place where this information was published.
Maybe it will help someone else.

Answer 2

Something here may help.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Hi,

Thank you for coming Microsoft Q&A forum. This is Joy from Microsoft Windows 10 &Windows Server support team.

I noticed your issue is out of our Windows Server support scope, after searched on Internet, we think your issue is more related with XML, System.Xml, MSXML and XmlLite topic. However, as XML, System.Xml, MSXML and XmlLite subforum is closed, we recommend to post your thread on Data Platform Development, to check if they have any hint about this issue. Or if they know the direction you should go to contact.

Thank you for your understanding.

Bests,

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.