Elastic Windows Event Explorer

Publisher - Microsoft-Windows-All-User-Install-Agent

Event ID 1301


The Windows All-User Install Agent detected an attempt to delete a temporary or mandatory profile for user SID %{Param1}. Package information for the user will be reset.

Event Data:

# Name In Type
Out Type
1 Param1 win:UnicodeString xs:string

Observed Windows Versions:

Version: 0

Fingerprint: YJPY6EIXTHOBQ