Hi All,
Is there different indexing for the ReplacementStrings array in the various Security eventids? Or am I seeing/doing things incorrectly. I'm looking at inserting the specific values into a sql table, but it looks as if I'll have to have different associations depending on the Security EventIDs.
The index differs between Event IDs 4738, 4724 (4723 and 4725) and 4728.
For EventID = 4738 (A user account was changed.)
RS0: -
RS1: Target Account/Account Name
RS2: Target Account/Account Domain
RS3: Target Account/Security ID
RS4: Subject/Security ID
RS5: Subject/Account Name
RS6: Subject/Account Domain
RS7: Subject/Logon ID
For EventID = 4724 (An attempt was made to reset an account's password.)(same indexing for 4723 and 4725
RS0: Target Account/Account Name
RS1: Target Account/Account Domain
RS2: Target Account/Security ID
RS3: Subject/Security ID
RS4: Subject/Account Name
RS5: Subject/Account Domain
RS6: Subject/Logon ID
RS7:
ForEventID - 4728 (A member was added to a security-enabled global group.)
RS0: Target Account/Account Name
RS1: Target Account/Security ID
RS2: Group/Group Name
RS3: Group/Group Domain
RS4: Group/Security ID
RS5: Subject/Security ID
RS6: Subject/Account Name
RS7: Subject/Account Domain
RS8: Subject/Logon ID
Also, is there some sort of "cheat sheet" that has the index numbering for Security Events (ReplacementStrings) laid out?
Thank you.
gdr
Onward through the fog......