<110>2024-07-26T21:25:54.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ServerAuditReports ]  [ REPORT_PROFILE = Scheduled Task Modification on 2008 for wayne.com ]  [ TIME_GENERATED = 1722043554 ]  [ RECORD_NUMBER = 515256692 ]  [ EVENT_NUMBER = 4702 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ SOURCE = nordc-dc-04.wayne.com ]  [ AUTHENTICATION_PACKAGE_NAME = - ]  [ LOGON_PROCESS_NAME = - ]  [ ACCOUNT_NAME = NORDC-DC-04$ ]  [ ACCOUNT_DOMAIN = MDS-ATL ]  [ ACCOUNT_SID = null ]  [ PRIMARY_LOGON_ID = 0x3e4 ]  [ CALLER_USER_NAME = NORDC-DC-04$ ]  [ CALLER_USER_DOMAIN = null ]  [ CALLER_LOGON_ID = null ]  [ NOTIFICATION_PACKAGE_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ TOKEN_ELEVATION_TYPE = null ]  [ PREVIOUS_TIME = null ]  [ NEW_TIME = null ]  [ USER_RIGHTS = null ]  [ USER_RIGHTS_VALUE = null ]  [ POLICY_CATEGORY = null ]  [ POLICY_SUB_CATEGORY = null ]  [ POLICY_CHANGES = null ]  [ FILE_NAME = \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask ]  [ APPLICATION_NAME = null ]  [ SCHEDULE_TIME = null ]  [ SCHEDULE_AT = , Everyday ]  [ FORMAT_MESSAGE = The scheduled job '\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask' was updated ]  [ SAM_ACCOUNT_NAME = null ]  [ DISPLAY_NAME = null ]  [ HOME_DIRECTORY = null ]  [ HOME_DRIVE = null ]  [ SCRIPT_PATH = null ]  [ PROFILE_PATH = null ]  [ PWD_LAST_SET = null ]  [ ACCOUNT_EXPIRY_DATE = null ]  [ PRIMARY_GROUP_ID = null ]  [ OLD_UAC_VALUE = null ]  [ NEW_UAC_VALUE = null ]  [ USER_ACCOUNT_CONTROL = null ]  [ LOGON_HOURS = null ]  [ REMARKS = A scheduled task was updated. ]  [ USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_SID = S-1-5-20 ]  [ USER_MGMT_TYPE = null ]  [ LOGON_TO = null ]  [ MEMBER_NAME = null ]  [ MEMBER_SID = null ]  [ GROUP_TYPE = null ]  [ GROUP_SCOPE = null ]  [ CALLER_MWAYNEINE_NAME = null ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = null ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = null ]  [ ACCOUNT_NAME_OU_GUID = null ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = null ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = null ]  [ CALLER_USER_OU_GUID = null ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ MANDATORY_LABEL = null ]  [ PROCESS_COMMAND_LINE = - ]  [ EXIT_STATUS = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ CREATOR_PROCESS_ID = null ]  [ CREATOR_PROCESS_NAME = null ]  [ SERVICE_NAME = null ]  [ SERVICE_FILE_NAME = null ]  [ SERVICE_TYPE = null ]  [ SERVICE_START_TYPE = null ]  [ SERVICE_ACCOUNT = null ] 
{
    "facilityCode": 13,
    "facilityLabel": "log audit",
    "fieldExtractorName": "ad_audit_plus",
    "localHostname": "Nordc-app-Dell",
    "localStartTime": "2024-07-26T21:25:54.000-04:00",
    "message": "<110>2024-07-26T21:25:54.000-04:00 Nordc-app-Dell ADAuditPlus:  [ Category = ServerAuditReports ]  [ REPORT_PROFILE = Scheduled Task Modification on 2008 for wayne.com ]  [ TIME_GENERATED = 1722043554 ]  [ RECORD_NUMBER = 515256692 ]  [ EVENT_NUMBER = 4702 ]  [ EVENT_TYPE = 8 ]  [ EVENT_TYPE_TEXT = Success ]  [ SOURCE = nordc-dc-04.wayne.com ]  [ AUTHENTICATION_PACKAGE_NAME = - ]  [ LOGON_PROCESS_NAME = - ]  [ ACCOUNT_NAME = NORDC-DC-04$ ]  [ ACCOUNT_DOMAIN = MDS-ATL ]  [ ACCOUNT_SID = null ]  [ PRIMARY_LOGON_ID = 0x3e4 ]  [ CALLER_USER_NAME = NORDC-DC-04$ ]  [ CALLER_USER_DOMAIN = null ]  [ CALLER_LOGON_ID = null ]  [ NOTIFICATION_PACKAGE_NAME = null ]  [ PROCESS_ID = null ]  [ PROCESS_NAME = null ]  [ TOKEN_ELEVATION_TYPE = null ]  [ PREVIOUS_TIME = null ]  [ NEW_TIME = null ]  [ USER_RIGHTS = null ]  [ USER_RIGHTS_VALUE = null ]  [ POLICY_CATEGORY = null ]  [ POLICY_SUB_CATEGORY = null ]  [ POLICY_CHANGES = null ]  [ FILE_NAME = \\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask ]  [ APPLICATION_NAME = null ]  [ SCHEDULE_TIME = null ]  [ SCHEDULE_AT = , Everyday ]  [ FORMAT_MESSAGE = The scheduled job '\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask' was updated ]  [ SAM_ACCOUNT_NAME = null ]  [ DISPLAY_NAME = null ]  [ HOME_DIRECTORY = null ]  [ HOME_DRIVE = null ]  [ SCRIPT_PATH = null ]  [ PROFILE_PATH = null ]  [ PWD_LAST_SET = null ]  [ ACCOUNT_EXPIRY_DATE = null ]  [ PRIMARY_GROUP_ID = null ]  [ OLD_UAC_VALUE = null ]  [ NEW_UAC_VALUE = null ]  [ USER_ACCOUNT_CONTROL = null ]  [ LOGON_HOURS = null ]  [ REMARKS = A scheduled task was updated. ]  [ USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_SID = S-1-5-20 ]  [ USER_MGMT_TYPE = null ]  [ LOGON_TO = null ]  [ MEMBER_NAME = null ]  [ MEMBER_SID = null ]  [ GROUP_TYPE = null ]  [ GROUP_SCOPE = null ]  [ CALLER_MWAYNEINE_NAME = null ]  [ ACCOUNT_SAM_ACCOUNT_NAME = null ]  [ ACCOUNT_DISPLAY_NAME = null ]  [ ACCOUNT_USER_PRINCIPAL_NAME = null ]  [ ACCOUNT_USER_GUID = null ]  [ ACCOUNT_DISTINGUISH_NAME = null ]  [ ACCOUNT_NAME_OU_GUID = null ]  [ ACCOUNT_USER_DEPARTMENT = null ]  [ ACCOUNT_USER_MANAGER_NAME = null ]  [ CALLER_SAM_ACCOUNT_NAME = null ]  [ CALLER_DISPLAY_NAME = null ]  [ CALLER_USER_PRINCIPAL_NAME = null ]  [ CALLER_USER_GUID = null ]  [ CALLER_DISTINGUISH_NAME = null ]  [ CALLER_USER_OU_GUID = null ]  [ CALLER_USER_DEPARTMENT = null ]  [ CALLER_USER_MANAGER_NAME = null ]  [ MANDATORY_LABEL = null ]  [ PROCESS_COMMAND_LINE = - ]  [ EXIT_STATUS = null ]  [ SOURCE_NAME = null ]  [ LOG_FILE_NAME = null ]  [ KEYWORDS_NAME = null ]  [ TASK_CATEGORY_NAME = null ]  [ TASK_CATEGORY_ID = null ]  [ EXTRA_COLUMN1 = null ]  [ EXTRA_COLUMN2 = null ]  [ EXTRA_COLUMN3 = null ]  [ EXTRA_COLUMN4 = null ]  [ EXTRA_COLUMN5 = null ]  [ EXTRA_COLUMN6 = null ]  [ EXTRA_COLUMN7 = null ]  [ EXTRA_COLUMN8 = null ]  [ EXTRA_COLUMN9 = null ]  [ EXTRA_COLUMN10 = null ]  [ CONFIGURED_DOMAIN_NAME = null ]  [ CREATOR_PROCESS_ID = null ]  [ CREATOR_PROCESS_NAME = null ]  [ SERVICE_NAME = null ]  [ SERVICE_FILE_NAME = null ]  [ SERVICE_TYPE = null ]  [ SERVICE_START_TYPE = null ]  [ SERVICE_ACCOUNT = null ] ",
    "messageType": "audit_log",
    "priority": 110,
    "program": "ADAuditPlus",
    "senderHost": "192.168.10.233",
    "sensitivity": "normal",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "ad_audit_plus",
    "tags": [
        "rfc3164",
        "ad_audit_plus",
        "audit_log"
    ]
}