Spelling error on Provider "Microsoft-Windows-CertificateServicesClient-Lifecycle-System"
hcs0 opened this issue · 0 comments
hcs0 commented
At least on Windows Server 2016, the name of the ETW Provider is Microsoft-Windows-CertificateServicesClient-Lifecycle-System with GUID BC0669E1-A10D-4A78-834E-1CA3C806C93B.
In https://github.com/nsacyber/Event-Forwarding-Guidance/tree/master/Events it is Microsoft-Windows-CertificateServicesClientLifecycle-System for the EventSource