DFIRHub

Windows event log · Microsoft-Windows-GroupPolicy/Operational4016 List of applicable Group Policy objects

Events 4016 and 5016 show the start and end of processing of groups of policies, including how long it took to apply each one in the end event.

  • Windows operational
  • 4 fields
  • Microsoft-Windows-GroupPolicy%4Operational.evtx
  • Microsoft-Windows-GroupPolicy

Fields EvtxECmd extracts

4 columns in the EvtxECmd CSV

  • PayloadData1GPO Title: %DescriptionString%
    • %DescriptionString% = /Event/EventData/Data[@Name="DescriptionString"]
  • PayloadData2GPO List: %ApplicableGPOList%
    • %ApplicableGPOList% = /Event/EventData/Data[@Name="ApplicableGPOList"]
  • PayloadData3GPOChange: %IsGPOListChanged%
    • %IsGPOListChanged% = /Event/EventData/Data[@Name="IsGPOListChanged"]
  • PayloadData4CSEExtensionName: %CSEExtensionName%
    • %CSEExtensionName% = /Event/EventData/Data[@Name="CSEExtensionName"]

Sample event

Event XML from the map file

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}"/>
    <EventID>4016</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2022-05-24T13:05:59.3535687Z"/>
    <EventRecordID>515206</EventRecordID>
    <Correlation ActivityID="{a5fbeca3-6758-456e-9209-c120909df110}"/>
    <Execution ProcessID="9748" ThreadID="11076"/>
    <Channel>Microsoft-Windows-GroupPolicy/Operational</Channel>
    <Computer>COMPUTER</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="CSEExtensionId">{35378eac-683f-11d2-a89a-00c04fbbcfa2}</Data>
    <Data Name="CSEExtensionName">Registry</Data>
    <Data Name="IsExtensionAsyncProcessing">false</Data>
    <Data Name="IsGPOListChanged">true</Data>
    <Data Name="GPOListStatusString">%%4102</Data>
    <Data Name="DescriptionString">GPO TITLE</Data>
    <Data Name="ApplicableGPOList">
      <GPO ID=" LIST OF GPO’s></EventData>
    </Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-GroupPolicy-Operational_Microsoft-Windows-GroupPolicy_4016.map(opens in new tab) by Tony Knutson and contributors(opens in new tab), MIT License(opens in new tab)