Elastic Windows Event Explorer


Publisher - Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider

Event ID 601

Message:

MDM ResourceManager: DeleteResource EnrollmentID: (%{Message1}) UserSID: (%{Message2}) URI: (%{Message3}).

Event Data:

# Name In Type
Out Type
1 Message1 win:UnicodeString xs:string
2 Message2 win:UnicodeString xs:string
3 Message3 win:UnicodeString xs:string

Observed Windows Versions:

Version: 0

Fingerprint: 6RFD2BBDDYF6E