Elastic Windows Event Explorer


Publisher - Microsoft-Windows-User Device Registration

Event ID 352

Message:

The Microsoft Passport key information was successfully deleted. 
Key ID: %{KeyId} 
User SID: %{UserSid}

Event Data:

# Name In Type
Out Type
1 KeyId win:UnicodeString xs:string
2 UserSid win:UnicodeString xs:string

Observed Windows Versions:

Version: 0

Fingerprint: NTCCOBNA6DCIK