TypeData/PoShEvents.Types.ps1xml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
<?xml version="1.0" encoding="utf-8" ?>
<Types>
    <Type>
        <Name>MyEvent.EventRecordType.PrintDocument</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>PrintJobId</Name>
                            <Name>UserName</Name>
                            <Name>ClientMachineName</Name>
                            <Name>PrinterName</Name>
                            <Name>PrinterPort</Name>
                            <Name>DocumentName</Name>
                            <Name>DocumentSizeBytes</Name>
                            <Name>DocumentPageCount</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.SystemRestartEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>ProviderName</Name>
                            <Name>Status</Name>
                            <Name>UserName</Name>
                            <Name>Reason</Name>
                            <Name>Details</Name>
                            <Name>Comment</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.LogonFailureEvent</Name>
        <Members>
            <ScriptProperty>
                <Name>Subject</Name>
                    <GetScriptBlock>
                        if ($this.SubjectUserName) {
                            ($this.SubjectDomainName + '\' + $this.SubjectUserName)
                        }
                    </GetScriptBlock>
            </ScriptProperty>
            <ScriptProperty>
                <Name>Target</Name>
                    <GetScriptBlock>
                        if ($this.TargetUserName) {
                            ($this.TargetDomainName + '\' + $this.TargetUserName)
                        }
                    </GetScriptBlock>
            </ScriptProperty>
            <ScriptProperty>
                <Name>SourceIPAddress</Name>
                    <GetScriptBlock>
                        $this.IpAddress
                    </GetScriptBlock>
            </ScriptProperty>
            <ScriptProperty>
                <Name>SourceIPPort</Name>
                    <GetScriptBlock>
                        $this.IpPort
                    </GetScriptBlock>
            </ScriptProperty>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>ProviderName</Name>
                            <Name>Subject</Name>
                            <Name>SubjectLogonId</Name>
                            <Name>WorkstationName</Name>
                            <Name>SourceIPAddress</Name>
                            <Name>SourceIPPort</Name>
                            <Name>LogonMethod</Name>
                            <Name>Target</Name>
                            <Name>Reason</Name>
                            <Name>LogonProcessName</Name>
                            <Name>ProcessName</Name>
                            <Name>AuthenticationPackageName</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.OSVersionFromEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>OperatingSystemVersion</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.RemoteLogonEvent</Name>
        <Members>
            <ScriptProperty>
                <Name>AccountName</Name>
                    <GetScriptBlock>
                        if ($this.TargetDomainName -and $this.TargetUserName) {
                            ($this.TargetDomainName + '\' + $this.TargetUserName)
                        } elseif ($this.TargetUserName) {
                            $this.TargetUserName
                        }
                    </GetScriptBlock>
            </ScriptProperty>
            <ScriptProperty>
                <Name>LogonId</Name>
                    <GetScriptBlock>
                        $this.TargetLogonId
                    </GetScriptBlock>
            </ScriptProperty>
            <ScriptProperty>
                <Name>SourceIPAddress</Name>
                    <GetScriptBlock>
                        $this.IpAddress
                    </GetScriptBlock>
            </ScriptProperty>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>EventType</Name>
                            <Name>AccountName</Name>
                            <Name>WorkstationName</Name>
                            <Name>SourceIPAddress</Name>
                            <Name>LogonMethod</Name>
                            <Name>LogonId</Name>
                            <Name>Reason</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.ServiceEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>EventType</Name>
                            <Name>ServiceName</Name>
                            <Name>ServiceMessage</Name>
                            <Name>ImagePath</Name>
                            <Name>ServiceType</Name>
                            <Name>StartType</Name>
                            <Name>AccountName</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.GPOProcessingEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>EventType</Name>
                            <Name>Action</Name>
                            <Name>Status</Name>
                            <Name>GPOApplied</Name>
                            <Name>GPOList</Name>
                            <Name>GroupPolicy</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.KMSClientEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>KMSHost</Name>
                            <Name>KMSHostPort</Name>
                            <Name>ClientMachineID</Name>
                            <Name>ClientTimestamp</Name>
                            <Name>CurrentActivationState</Name>
                            <Name>CurrentActivationCount</Name>
                            <Name>LicenseStateExpirationMin</Name>
                            <Name>LicenseStateExpiration</Name>
                            <Name>NextActivationAttempt</Name>
                            <Name>ActivationStatus</Name>
                            <Name>ADActivationObjectName</Name>
                            <Name>ADActivationObject</Name>
                            <Name>ProductSkuId</Name>
                            <Name>ProductSkuName</Name>
                            <Name>MinActivateCount</Name>
                            <Name>KmsErrorCode</Name>
                            <Name>KmsErrorMessage</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.KMSHostEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>MinActivateCount</Name>
                            <Name>ClientFqdn</Name>
                            <Name>ClientMachineID</Name>
                            <Name>ClientTimestamp</Name>
                            <Name>IsClientVM</Name>
                            <Name>LicenseState</Name>
                            <Name>LicenseStateExpirationMin</Name>
                            <Name>LicenseStateExpiration</Name>
                            <Name>ProductSkuId</Name>
                            <Name>ProductSkuName</Name>
                            <Name>KmsErrorCode</Name>
                            <Name>KmsErrorMessage</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
    <Type>
        <Name>MyEvent.EventRecordType.KMSHostLicenseCheckEvent</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>ActivationId</Name>
                            <Name>ApplicationName</Name>
                            <Name>LicensingStatusMessage</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
        <Type>
        <Name>MyEvent.EventRecordType.Default</Name>
        <Members>
            <MemberSet>
                <Name>PSStandardMembers</Name>
                <Members>
                    <PropertySet>
                    <Name>DefaultDisplayPropertySet</Name>
                        <ReferencedProperties>
                            <Name>ComputerName</Name>
                            <Name>TimeCreated</Name>
                            <Name>Id</Name>
                            <Name>Level</Name>
                            <Name>ProviderName</Name>
                            <Name>Message</Name>
                            <Name>EventData</Name>
                            <Name>UserData</Name>
                        </ReferencedProperties>
                    </PropertySet>
                </Members>
            </MemberSet>
        </Members>
    </Type>
</Types>