Elastic Windows Event Explorer

Publisher - LsaSrv

Event ID 303


The security package does not cache the user's sign on credentials.

Package Name:	%{PackageName}
User Name:	%{UserName}
Domain Name:	%{DomainName}
Protected User:	%{ProtectedUser}

Event Data:

# Name In Type
Out Type
1 PackageName win:UnicodeString xs:string
2 UserName win:UnicodeString xs:string
3 DomainName win:UnicodeString xs:string
4 ProtectedUser win:UInt32 xs:unsignedInt

Observed Windows Versions:

Version: 0

Fingerprint: SKAQZBFKM4HH4