AccessGranted AccessList AccessMask AccessReason AccessRemoved AccountDomain AccountExpires AccountName AccountSessionIdentifier Action ActiveProfile AddedCAPs AdditionalInfo AdditionalInfo2 AdvancedOptions AhAuthType AlgorithmName AllowedToDelegateTo AppCorrelationID AppInstance Application AppName AsIsCAPs Attribute AttributeLDAPDisplayName Attributes AttributeSyntaxOID AttributeValue AuditFilter AuditPolicyChanges AuditsDiscarded AuditSourceName AuditStatusCode AuthenticationLevel AuthenticationPackage AuthenticationPackageName AuthenticationProvider AuthenticationServer AuthenticationService AuthenticationSetId AuthenticationSetName AuthenticationType BackupFileName BackupType BaseCRLHash BaseCRLNumber BaseCRLThisUpdate CACertificateHash CAConfigurationId CalledStationID CallerDomainName CallerLogonId CallerProcessId CallerProcessName CallerUserName CallerUserSid CallingStationID CalloutId CalloutKey CalloutName CalloutType CAName CAPublicKeyHash Categories CategoryId Certificate CertificateDatabaseHash CertificateHash CertificateSerialNumber CertIssuerName CertSerialNumber CertThumbprint ChangeType CipherType ClassId ClassName ClientAddress ClientCreationTime ClientDomain ClientIPAddress ClientLogonId ClientName ClientProcessId ClientUserName CollisionTargetName CollisionTargetType CommandLine CompatibleIds ComputerAccountChange ComputerName Conditions ConfigAccessPolicy ConfiguredNames ConnectionSecurityRuleId ConnectionSecurityRuleName ContextName Count CountOfCredentialsReturned CrashOnAuditFailValue CredType CRLNumber CryptoAlgorithms CryptographicSetId CryptographicSetName DataDescription DCDNSName DeletedCAPs DeltaCRLHash DeltaCRLIndicator DeltaCRLNumber DeltaCRLThisUpdate DestAddress DestinationDRA DestinationvSwitchPort DestPort DeviceClaims DeviceDescription DeviceId DeviceName DHGroup Direction DisabledPrivilegeList DisableIntegrityChecks DisplayName Disposition DnsHostName DnsName DomainBehaviorVersion DomainName DomainPolicyChanged DomainSid DSName DSType Dummy Duration EAPErrorCode EAPReasonCode EapRootCauseString EAPType EfsPolicyChange ElevatedToken EMAuthMethod EMImpersonationState EnabledPrivilegeList EnableRestrictedPermissions EndUSN Entry EntryType Error ErrorCode EspAuthType EtherType EventCount EventCountTotal EventId EventIdx EventSourceId ExpirationTime ExtendedQuarantineState ExtensionData ExtensionDataType ExtensionName ExtensionPolicyFlags FailureCode FailureId FailurePoint FailureReason FatalCode FileName Filter FilterId FilterKey FilterName FilterRTID FilterType Flags FlightSigning ForceLogoff ForestRoot ForestRootSid FullyQualifiedSubjectMachineName FullyQualifiedSubjectUserName FunctionName GPOList Group GroupMembership GroupPolicyApplied GroupTypeChange GUID HandleId HardwareIds HomeDirectory HomePath HostedCacheName HypervisorDebug HypervisorLaunchType HypervisorLoadOptions Identity ImpersonationLevel InboundSpi InitiatorCookie InterfaceId InterfaceName InterfaceType InterfaceUuid IntfGuid InvalidCallName IpAddress IpAddresses IpPort IpProtocol IpSecSecurityAssociationId IpSecSecurityAssociationName IsBaseCRL KerberosPolicyChange KernelDebug KeyContainer KeyFilePath KeyingModuleName KeyLength KeyModName KeyName KeyType KRAHashes LayerId LayerKey LayerName LayerRTID LifetimeKilobytes LifetimePackets LifetimeSeconds LinkName LmPackageName LoadOptions LocalAddress LocalAddressMask LocalEMCertHash LocalEMIssuingCA LocalEMPrincipalName LocalEMRootCA LocalKeyModPort LocalMac LocalMMCertHash LocalMMIssuingCA LocalMMPrincipalName LocalMMRootCA LocalPort LocalTunnelEndpoint LocationInformation LockoutDuration LockoutObservationWindow LockoutThreshold LogDroppedPacketsEnabled LoggingResult LogonGuid LogonHours LogonID LogonProcessName LogonType LogSuccessfulConnectionsEnabled MachineAccountQuota MachineInventory MainModeSaId MandatoryLabel MappedName MappingBy MasterKeyId MaxPasswordAge MediaType MemberName MembershipExpirationTime MemberSid Message MessageID MinPasswordAge MinPasswordLength MixedDomainMode MMAuthMethod MMCipherAlg MMFilterID MMImpersonationState MMIntegrityAlg MMLifetime MMSAID Mode ModifiedCAPs ModifiedObjectProperties Module ModuleName MulticastFlowsEnabled NamingContext NASIdentifier NASIPv4Address NASIPv6Address NASPort NASPortType NetbiosName NetworkPolicyName NewBlockedOrdinals NewDate NewIgnoreDefaultSettings NewIgnoreLocalSettings NewMaxUsers NewObjectDN NewProcessId NewProcessName NewRemark NewSd NewSecurityDescriptor NewSecuritySettings NewShareFlags NewSigningCertificateHash NewState NewTargetUserName NewTemplateContent NewTime NewUacValue NewValue NewValueType NextPublish NextPublishForBaseCRL NextPublishForDeltaCRL NextUpdate Node notification NotificationPackageName Object ObjectClass ObjectCollectionName ObjectDN ObjectGUID ObjectIdentifyingProperties ObjectName ObjectPath ObjectProperties ObjectServer ObjectType ObjectValueName ObjectVirtualPath OemInformation OldBlockedOrdinals OldIgnoreDefaultSettings OldIgnoreLocalSettings OldMaxUsers OldObjectDN OldRemark OldSd OldSecurityDescriptor OldShareFlags OldTargetUserName OldTemplateContent OldUacValue OldValue OldValueType OpCorrelationID Operation OperationId OperationMode OperationName OperationType Options Ordinal OutboundSpi Package PackageName PackageSid PacketsDiscarded param1 param2 param3 ParentProcessName PasswordHistoryLength PasswordLastSet PasswordProperties PeerMac PeerName PeerPrivateAddress Policy PolicyName Position PreAuthType PreviousDate PreviousTime PrimaryGroupId PrivateKeyUsageCount PrivilegeList ProcessCreationTime ProcessId ProcessName ProductName Profile ProfileChanged ProfilePath Profiles ProfileUsed Properties PropertyIndex PropertyName PropertyType PropertyValue ProtectedDataFlags Protocol ProtocolSequence ProviderContextKey ProviderContextName ProviderContextType ProviderKey ProviderName ProviderType ProxyPolicyName PuaCount PuaPolicyId Publisher PublishURLs QMFilterID QMLimit QuarantineGraceTime QuarantineHelpURL QuarantineSessionID QuarantineSessionIdentifier QuarantineState QuarantineSystemHealthResult QuickModeFilter QuickModeSaId ReadOperation Reason ReasonCode ReasonForRejection ReasonText RecoveryKeyId RecoveryReason RecoveryServer RelativeTargetName RemoteAddress RemoteAddressMask RemoteAdminEnabled RemoteEMCertHash RemoteEMIssuingCA RemoteEMPrincipalName RemoteEMRootCA RemoteEventLogging RemoteIpAddress RemoteKeyModPort RemoteMachineID RemoteMMCertHash RemoteMMIssuingCA RemoteMMPrincipalName RemoteMMRootCA RemotePort RemotePrivateAddress RemoteTunnelEndpoint RemoteUserID ReplicationEvent ReplicationStatusCode Requester RequestId RequestType Resource ResourceAttributes ResourceManager ResponderCookie RestrictedAdminMode RestrictedPermissions RestrictedSidCount ReturnCode RevocationReason Role RoleSeparationEnabled RowsDeleted RuleAttr RuleId RuleName SamAccountName Schema SchemaFriendlyName Scope ScopeName ScriptPath SearchString SecurityDescriptor SecurityError SecurityPackageName SecuritySettings SerialNumber ServerNames ServerPortName Service ServiceAccount ServiceFileName ServiceName ServicePrincipalNames ServiceSid ServiceStartType ServiceType SessionId SessionName SettingType SettingValue ShareLocalPath ShareName SidFilteringEnabled SidHistory SidList SiloName SourceAddr SourceAddress SourceDRA SourceHandleId SourcePort SourceProcessId SourceSid SourceUserName SourcevSwitchPort SPI SpnName SSID StagingReason StartUSN State Status StatusCode StoreUrl SubcategoryGuid SubcategoryId Subject SubjectDomainName SubjectKeyIdentifier SubjectLogonId SubjectMachineName SubjectMachineSID SubjectUserDomainName SubjectUserName SubjectUserSid SubLayerKey SubLayerName SubLayerType SubStatus TableId TargetDomainName TargetHandleId TargetInfo TargetLinkedLogonId TargetLogonGuid TargetLogonId TargetName TargetOutboundDomainName TargetOutboundUserName TargetProcessId TargetProcessName TargetServer TargetServerName TargetSid TargetUserDomain TargetUserName TargetUserSid TaskContent TaskContentNew TaskName TdoAttributes TdoDirection TdoSid TdoType TemplateContent TemplateDSObjectFQDN TemplateInternalName TemplateOID TemplateSchemaVersion TemplateVersion TestSigning TGT Lifetime TicketEncryptionType TicketOptions TokenElevationType TopLevelName TrafficSelectorId TransactionId TransitedServices TransmittedServices TransportFilterId TreeDelete TunnelId Type TypeOfChange UserAccountControl UserClaims UserName UserParameters UserPrincipalName UserSid UserUPN UserWorkstations USN ValidFrom ValidTo Value VendorIds VirtualAccount VirtualFileName VlanTag VsmLaunchType vSwitch ID Weight Workstation WorkstationName