| Variable | Display Name | Description |
|---|---|---|
| %FORMAT_MESSAGE% | Description | General description by ADAudit Plus with necessary information |
| %OBJECT_NAME% | Absolute Name | Full name of the Object |
| %ACCESS_MASK% | Access Mask | Operation performed by users in integer format |
| %USERNAME% | Accessed by | Who accesed the operation(File , Folder) |
| %ACCESSES% | Accesses | Operation performed by users |
| %ACCOUNT_DOMAIN% | Account Domain | Actual Domain Name |
| %ACCOUNT_EXPIRY_DATE% | Account Expiry Date | Expiry date of An Account |
| %ACCOUNT_NAME% | Account Name | User Name |
| %ACCOUNT_SESSION_IDENTIFIER% | Account Session Identifier | Logon Session ID |
| %ACCOUNT_SID% | Account SID | Object SID string |
| %ACCOUNT_EXPIRY_DATE% | Account Expiry Date | Expiry date of An Account |
| %OBJECT_NAME% | Absolute Name | Full name of the Object |
| %USERNAME% | Accessed by | Who accesed the operation(File , Folder) |
| %ACCESSES% | Accesses | Operation performed by users |
| %ACCESS_TYPE% | Access Type | Type of operation in number |
| %ACCESS_TYPE_TEXT% | Access Type | Type of operation in text |
| %ACCOUNT_DOMAIN% | Account Domain | Actual Domain Name |
| %ACCOUNT_EXPIRY_DATE% | Account Expiry Date | Expiry date of An Account |
| %ACCOUNT_NAME% | Account Name | User Name |
| %ACCOUNT_SESSION_IDENTIFIER% | Account Session Identifier | Logon Session ID |
| %ACCOUNT_SID% | Account SID | Object SID string |
| %ACTION% | Action | Operation type |
| %ALERT_ID% | Alert Id | Alert Id |
| %ALERT_MESSAGE% | Alert Message | Value in the Alert Message |
| %ALLOWED_TO_DELEGATE_TO% | Allowed to delegate to | |
| %APPLICATION_NAME% | Application Name | File Name |
| %APPLIES_TO% | Applies to | Permissions applies |
| %USER_RIGHTS_VALUE% | Assigned Rights | Rights Assigned to User |
| %ATTRIBUTES_TEXT% | Attributes Text | Modified Attributes |
| %ATTRIBUTES_NEW_VALUE% | New Value | Change in Attribute New Value |
| %ATTRIBUTES_OLD_VALUE% | Old Value | Change in Attribute Old Value |
| %AUTHENTICATION_PACKAGE% | Authentication Package | Type of Authentication Name |
| %AUTHENTICATION_PACKAGE_NAME% | Authentication Package Name | Type of Authentication Name |
| %AUTHENTICATION_PROVIDER% | Authentication Provider | Type of Authentication Provider |
| %AUTHENTICATION_SERVER% | Authentication Server | Server Where the Audthentication happened |
| %AUTHENTICATION_TYPE% | Authentication Type | Method of Authentication |
| %CALLED_STATION% | Called Station | NPS Called station(Where to) |
| %CALLER_LOGON_ID% | Caller Logon ID | Login ID |
| %CALLER_MACHINE_NAME% | Caller Machine Name | Machine Name of the User |
| %CALLER_USER_DOMAIN% | Caller User Domain | Domain Name |
| %CALLER_USER_NAME% | Caller User Name | Name of the User who made the action |
| %CALLER_LOGON_ID% | Caller User SID | User SID |
| %CALLER_USER_SID% | Caller User SID | SID of the User who made the action |
| %CALLING_STATION% | Calling Station | NPS Calling station(from where) |
| %CHANGE_TYPE_TEXT% | Change Type | Type of Change in Text format (Added/Removed/Modified) |
| %MODIFICATION_TYPE% | Change Type | Type of Modification |
| %CLIENT_DOMAIN% | Client Domain | Domain Name |
| %CLIENT_HOST_NAME% | Client Host Name | Name Of the Client Machine |
| %CLIENT_MC_NAME% | Client IP Address | Ip Address of the Client Machine |
| %CLIENT_LOGIN_ID% | Client Login ID | Login ID |
| %CLIENT_HOST_NAME% | Client Machine Name | Name Of the Client Machine |
| %CLIENT_USER_NAME% | Client User Name | Name of the User who made the action |
| %COMMENT_NEW_VALUE% | Comment New Value | New Value |
| %COMMENT_OLD_VALUE% | Comment Old value | Old Value |
| %ACCOUNT_NAME% | Computer Name | Computer Name |
| %USERNAME% | Created by | Name of the User who made the action |
| %EVENT_TYPE% | Creation Status | Type of the event in integer(8 or 16) |
| %EVENT_TYPE_TEXT% | Creation Status Code | Type of the event in string |
| %TIME_GENERATED% | Creation Time | Creation Time |
| %USERNAME% | Deleted by | Name of the User who made the action |
| %TIME_GENERATED% | Deleted Time | Deleted Time |
| %DISPLAY_NAME% | Display Name | Display Name |
| %DNS_HOST_NAME% | DNS Host Name | DNS Host Name |
| %ACCOUNT_DOMAIN% | Domain | Actual Domain Name |
| %CALLER_USER_DOMAIN% | Domain | Domain Name |
| %DOMAIN% | Domain | Domain Name |
| %DOMAIN_NAME% | Domain | Domain Name |
| %SOURCE% | Domain Controller | Source Domain Controller Where the User Perfoms Logon |
| %EAP_TYPE% | EAP Type | Extension Authentication protocol type |
| %EVENT_TYPE% | Event Code | Type of the event in integer(8 or 16) |
| %TIME_PERIOD% | Event Fetch Interval | Event Fetch Interval |
| %EVENT_NUMBER% | Event Number | Event Number |
| %EVENT_TYPE% | Event Type | Type of the event in integer(8 or 16) |
| %EVENT_TYPE_TEXT% | Event Type | Type of the event in string |
| %EVENT_TYPE% | Event Type Code | Type of the event in integer(8 or 16) |
| %EVENT_TYPE_TEXT% | Event Type Text | Type of the event in string |
| %EXTENDED_RESULT% | Extended Result | Extended Result for NPS logon |
| %ERROR_CODE% | Failure Code | Failure reason in hexadecimal format |
| %ERROR_CODE_TEXT% | Failure Reason | Failure reason in Text |
| %ERROR_CODE% | Failure Type | Failure reason in hexadecimal format |
| %ERROR_CODE_TEXT% | Failure Type | Failure reason in Text |
| %FILE_NAME% | File / Folder Name | Name Of the File/ Folder |
| %APPLICATION_NAME% | File Name | File Name |
| %FILE_NAME% | File Name | Name Of the File/ Folder |
| %PROCESS_NAME% | File Name | Name Of the File |
| %NAME% | File Server Name | Name of the File Server |
| %FORCE_LOGOFF% | Force Logoff | Force Log-off |
| %CANONICAL_NAME% | Full Account Name | Canonical Name |
| %OBJECT_NAME% | GPO Distinguished Name | Full name of the GPO |
| %OBJECT_GUID% | GPO Name | GPO Name |
| %OBJECT_NAME_TEXT% | GPO Name | GPO Name |
| %ACCOUNT_NAME% | Group Name | Group Name |
| %GROUP_SCOPE% | Group Scope | Scope of Group(Local/ Global/Universal) |
| %GROUP_TYPE% | Group Type | Type of Group(security/Distribution) |
| %SYSTEM_HEALTH_VALIDATOR_RESULT% | Health Validator Result | Health Validator Result In NPS |
| %HELP_URL% | Help URL | Help URL |
| %HOME_DIRECTORY% | Home Directory | Users Home Directory Path |
| %HOME_DRIVE% | Home Drive | Users Home Drive |
| %OEM_INFO% | Information | OEM Information in Integer |
| %FILE_LOCATION% | Location | Location of the file/Folder |
| %TIME_GENERATED% | Lockedout Time | Lockedout Time |
| %TIME_GENERATED% | Locked out Time | Locked out Time |
| %LOCKOUT_DURATION% | LockOut Duration | Duration of Account getting Lockedout |
| %LOCKOUT_OBSERV_WINDOW% | LockOut Observation Window | Time When the System is Logged off |
| %LOCKOUT_THRESHOLD% | LockOut Threshold | Lockout thershold |
| %LOGON_ID% | Login ID | Logged in Sessions ID for a User |
| %LOGOFF_TIME% | Logoff Time | Time When the System is Logged off |
| %TIME_GENERATED% | Logoff Time | Logoff Time |
| %LOGON_TYPE% | Logon Code | Type of logon in Integer Format |
| %LOGON_HOURS% | Logon Hours | Duration Of Logon |
| %LOGON_PROCESS% | Logon Process | Logon process in String |
| %LOGON_PROCESS_NAME% | Logon Process Name | Logon Process Name |
| %LOGON_SERVICE% | Logon Service | Logon Service |
| %LOGON_TIME% | Logon Time | Time When the System is Logged in |
| %TIME_GENERATED% | Logon Time | Logon Time |
| %LOGON_TYPE_TEXT% | Logon Type | Type of logon in Text Format |
| %LOGON_TO% | Logon Workstation | Where the User has Logged in |
| %MAX_PASSWORD_AGE% | Maximum Password Age | Maximum Password Age |
| %MEMBER_NAME% | Member Name | Name of the Member from a Group |
| %NAME% | Member Server Name | Name of the Member Server |
| %MEMBER_SID% | Member SID | SID of the Member |
| %FORMAT_MESSAGE% | Message | General Description by ADAudit Plus with Necessary Information |
| %MIN_PASSWORD_AGE% | Minimum Password Age | Minimum Password Age |
| %MIN_PASSWORD_LENGTH% | Minimum Password Length | Minimum Password Length |
| %MIXED_DOMAIN_MODE% | Mixed Domain Mode | Mixed Domain Mode |
| %COMP_MGMT_TYPE% | Modification Type | Compter Modification Type |
| %GROUP_MGMT_TYPE% | Modification Type | Group Modification Type |
| %USER_MGMT_TYPE% | Modification Type | User Modification Type |
| %ATTRIBUTES_TEXT% | Modified Attributes | Modified Attributes |
| %USER_MGMT_TYPE% | Modified Attributes | Attributes Modified in User Object |
| %CALLER_USER_NAME% | Modified by | Name of the User who made the action |
| %USERNAME% | Modified by | Name of the User who made the action |
| %MODIFIED_PROPS% | Modified Properties | Modified properties of a User Object |
| %TIME_GENERATED% | Modified Time | Modified Time |
| %CALLER_CANONICAL_NAME% | Name | Canonical Name |
| %NAS_IDENTIFIER% | NAS Identifier | NAS Identifier Network policy server |
| %NAS_IPV4_ADDRESS% | NAS IPv4 Address | Ip Address |
| %NAS_IPV6_ADDRESS% | NAS IPv6 Address | Ip Address |
| %NAS_PORT% | NAS Port | Port number |
| %NAS_PORT_TYPE% | NAS Port Type | NAS Port Type |
| %NETWORK_POLICY_NAME% | Network Policy Name | Name of the Network Policy in NPS report |
| %ACCOUNT_DOMAIN% | New Account Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New Account Name | User Name |
| %ACCOUNT_DOMAIN% | New Computer Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New Computer Name | Computer Name |
| %ADDITIONAL_INFO% | New GPO Distinguished Name | Distinguished Name |
| %ADDITIONAL_INFO2_TEXT% | New GPO Name | GPO or OU Name |
| %ACCOUNT_DOMAIN% | New Group Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New Group Name | Group Name |
| %ADDITIONAL_INFO% | New OU Distinguished Name | Distinguished Name |
| %ADDITIONAL_INFO2_TEXT% | New OU Name | GPO or OU Name |
| %NEW_PERMISSIONS% | New Permission | Added Permissions |
| %NEW_SEC_DESC% | New Permission | New Security Descriptions |
| %NEW_TIME% | New Time | New Changed system time by User |
| %NEW_UAC_VALUE% | New UAC Value | New UAC Value |
| %NEW_UAC_VALUE% | New User Account Control Value | New UAC Value |
| %ACCOUNT_DOMAIN% | New User Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New User Name | User Name |
| %ATTRIBUTES_NEW_VALUE% | New value | Change in Attribute New Value |
| %SETTING_NEW_VALUE% | New value | New value |
| %NOTIFICATION_PACKAGE_NAME% | Notification Package Name | Notification Package Name |
| %OBJECT_CLASS% | Object Class | Object Class |
| %OBJECT_CLASS_TEXT% | Object Class | Object Class Text |
| %OBJECT_TYPE_TEXT% | Object Class | Object Type in Text (OU, Container) |
| %OBJECT_NAME_TEXT% | Object Name | Object class Text |
| %OBJECT_SERVER% | Object Server | Object Server like Security |
| %OBJECT_TYPE% | Object Type | Object Type like File or Folder |
| %OLD_ACCOUNT_NAME% | Old Computer Name | Old Computer Name |
| %OLD_ACCOUNT_NAME% | Old Group Name | Old Group Name |
| %OLD_UAC_VALUE% | Old UAC Value | Old UAC Value |
| %OLD_UAC_VALUE% | Old User Account Control Value | Old User Account Control Value |
| %OLD_ACCOUNT_NAME% | Old User Name | Old User Name |
| %ATTRIBUTES_OLD_VALUE% | Old Value | Change in Attribute Old Value |
| %SETTING_OLD_VALUE% | Old Value | Old Value |
| %ORIGINAL_PERMISSIONS% | Original Permission | Original Permission |
| %ORIGINAL_SEC_DESC% | Original Permission | Original Permission |
| %OS_VERSION% | OS Version | OS Version |
| %OBJECT_NAME% | OU Distinguished Name | OU Name |
| %OBJECT_NAME_TEXT% | OU Name | OU Name |
| %OBJECT_LOCATION_TEXT% | Parent Object | OU Parent Location |
| %OBJECT_TYPE_TEXT% | Parent Object Class | Object Type in Text (OU, Container) |
| %OBJECT_NAME_TEXT% | Parent Object Name | OU Parent Location |
| %PASSWORD_HIST_LENGTH% | Password History Length | Password History Length |
| %PWD_LAST_SET% | Password Last Set | Password Last Set |
| %PASSWORD_PROP% | Password Property | Password Complextity |
| %PERMISSION% | Permission | Current Permission |
| %ACL_CHANGE% | Permission modified | Permission Changes |
| %POLICY_CATEGORY% | Policy Category | Policy Category |
| %POLICY_CHANGES% | Policy Changes | Policy Changes |
| %POLICY_PATH% | Policy Path | Path Of the Policy located |
| %POLICY_SUB_CATEGORY% | Policy Sub Category | Sub Category of the Policy |
| %PREVIOUS_TIME% | Previous Time | Previous Time |
| %PRIMARY_DOMAIN% | Primary Domain | Domain Name |
| %PRIMARY_USER_NAME% | Primary User Name | User Name |
| %PRIVILEGES% | Privileges | Privileges |
| %PRIVILEGES_USED% | Privileges Used | Privileges Used |
| %PROCESS_NAME% | Process Name | Process Name |
| %PROFILE_PATH% | Profile Path | Profile Path |
| %QUARANTINE_GRACE_TIME% | Quarantine Grace Time | Quarantine Grace Time in NPS server |
| %CLIENT_HOST_NAME% | Radius Client Host Name | Name Of the Client Machine |
| %CLIENT_MC_NAME% | Radius Client IP Address | Ip Address of the Client Machine |
| %QUARANTINE_GRACE_TIME% | Quarantine Grace Time | Quarantine Grace Time in NPS server |
| %REASON% | Reason | Reason in Text format |
| %REASON_CODE% | Reason Code | Reason in integer format |
| %RECORD_NUMBER% | Record Number | Record Number |
| %USER_RIGHTS_VALUE% | Removed Rights | User Rights Removed |
| %REMARKS% | Remarks | Default message |
| %REQUEST_POLICY_NAME% | Request Policy Name | Policy Name |
| %USER_RIGHTS% | Rights | User Rights |
| %USER_RIGHTS_VALUE% | Rights Value | User Rights Value |
| %SAM_ACCOUNT_NAME% | SAM Account Name | SAM Account Name |
| %SCRIPT_PATH% | Script Path | Script Path of the User Object |
| %SECURITY_PRINCIPAL% | Security Principal | Security Principal |
| %SOURCE% | Server | Source Server Where the User Perfoms Logon |
| %SERVICE_PRINCIPAL_NAME% | Service Principal Name | Service Principal Name |
| %SETTING_NAME% | Setting Name | Name of Policy Settings |
| %ACCOUNT_SID% | SID | Object SID string |
| %CALLER_USER_SID% | SID | SID of the User who made the action |
| %USER_SID% | SID | SID of the User |
| %SID_HISTORY% | SID History | History of SID |
| %SOURCE% | Source | Source Workstation Where the User Perfoms Logon |
| %SOURCE% | Source Computer | Source Workstation Where the User Perfoms Logon |
| %SOURCE_PORT% | Source Port | Port number |
| %MESSAGE% | Status | General Description by ADAudit Plus with Necessary Information |
| %TERMINATED_TIME% | Terminated Time | Terminated Time |
| %TIME_GENERATED% | Time | Time Generated |
| %TIME_GENERATED% | Time Accessed | Accesed Time |
| %TIME_GENERATED% | Time created | Time of the creation |
| %TIME_GENERATED% | Time Deleted | Time of the Deletion |
| %CREATION_TIME% | Time Generated | Time When created |
| %TIME_GENERATED% | Time Modified | Time of the Modification |
| %ACE_TYPE% | Type | Permission Type |
| %UNC_NAME% | UNC Name | UNC Name |
| %USER_ACCOUNT_CONTROL% | User Account Control | User Account Control |
| %ACCOUNT_NAME% | User Name | User Name |
| %CALLER_USER_NAME% | User Name | Name of the User who made the action |
| %USERNAME% | User Name | User Name Windows 2003 |
| %USER_PRINCIPAL_NAME% | User Principal Name | User Principal Name |
| %USER_RIGHTS% | User Rights | User Rights in Value |
| %USER_SID% | User SID | SID Of the user |
| %TIME_GENERATED% | When | Time Generated |
| %SOURCE% | Where | Source Workstation Where the User Perfoms Logon |
| %CLIENT_USER_NAME% | Who changed | Name of the User who made the action |
| %CLIENT_USER_NAME% | Who Created | Name of the User who made the action |
| %CLIENT_USER_NAME% | Who deleted | Name of the User who made the action |
| %CLIENT_USER_NAME% | Who Modified | Name of the User who made the action |
| %SOURCE% | Workstation Name | Source Workstation Where the User Perfoms Logon |
| %EVENT_TYPE% | Event Code | Type of the event in integer(8 or 16) |
| %NEW_UAC_VALUE% | New User account control Value | New UAC Value |
| %ALLOWED_TO_DELEGATE_TO% | Allowed to delegate to | |
| %USER_RIGHTS_VALUE% | Assigned Rights | Rights Assigned to User |
| %AUTHENTICATION_PACKAGE% | Authentication Package | Type of Authentication Name |
| %AUTHENTICATION_PROVIDER% | Authentication Provider | Type of Authentication Provider |
| %AUTHENTICATION_SERVER% | Authentication Server | Server Where the Audthentication happened |
| %AUTHENTICATION_TYPE% | Authentication Type | Method of Authentication |
| %CALLED_STATION% | Called Station | NPS Called station(Where to) |
| %CALLER_LOGON_ID% | Caller Logon ID | Login ID |
| %CALLER_MACHINE_NAME% | Caller Machine Name | Machine Name of the User |
| %CALLER_USER_DOMAIN% | Caller User Domain | Domain Name |
| %CALLER_USER_NAME% | Caller User Name | Name of the User who made the action |
| %CALLER_LOGON_ID% | Caller User SID | User SID |
| %CALLER_USER_SID% | Caller User SID | SID of the User who made the action |
| %CALLING_STATION% | Calling Station | NPS Calling station(from where) |
| %CLIENT_DOMAIN% | Client Domain | Domain Name |
| %CLIENT_HOST_NAME% | Client Host Name | Name Of the Client Machine |
| %CLIENT_MC_NAME% | Client IP Address | Ip Address of the Client Machine |
| %CLIENT_LOGIN_ID% | Client Login ID | Login ID |
| %CLIENT_HOST_NAME% | Client Machine Name | Name Of the Client Machine |
| %CLIENT_USER_NAME% | Client User Name | Name of the User who made the action |
| %ACCOUNT_NAME% | Computer Name | Computer Name |
| %TIME_GENERATED% | Creation Time | Creation Time |
| %USERNAME% | Deleted by | Name of the User who made the action |
| %TIME_GENERATED% | Deleted Time | Deleted Time |
| %DISPLAY_NAME% | Display Name | Display Name |
| %DNS_HOST_NAME% | DNS Host Name | DNS Host Name |
| %ACCOUNT_DOMAIN% | Domain | Actual Domain Name |
| %CALLER_USER_DOMAIN% | Domain | Domain Name |
| %DOMAIN% | Domain | Domain Name |
| %SOURCE% | Domain Controller | Source Domain Controller Where the User Perfoms Logon |
| %EAP_TYPE% | EAP Type | Extension Authentication protocol type |
| %EVENT_TYPE% | Event Code | Type of the event in integer(8 or 16) |
| %EVENT_NUMBER% | Event Number | Event Number |
| %EVENT_TYPE% | Event Type | Type of the event in integer(8 or 16) |
| %EVENT_TYPE_TEXT% | Event Type | Type of the event in string |
| %EVENT_TYPE% | Event Type Code | Type of the event in integer(8 or 16) |
| %EVENT_TYPE_TEXT% | Event Type Text | Type of the event in string |
| %EVENT_TYPE_TEXT% | EVENT_TYPE_TEXT | Type of the event in string |
| %EXTENDED_RESULT% | Extended Result | Extended Result for NPS logon |
| %ERROR_CODE% | Failure Code | Failure reason in hexadecimal format |
| %ERROR_CODE_TEXT% | Failure Reason | Failure reason in Text |
| %ERROR_CODE_TEXT% | Failure Type | Failure reason in Text |
| %FILE_NAME% | File / Folder Name | Name Of the File/ Folder |
| %APPLICATION_NAME% | File Name | File Name |
| %PROCESS_NAME% | File Name | Name Of the File |
| %FORCE_LOGOFF% | Force Logoff | Force Log-off |
| %CANONICAL_NAME% | Full Account Name | Canonical Name |
| %OBJECT_NAME% | GPO Distinguished Name | GPO Name |
| %OBJECT_NAME_TEXT% | GPO Name | GPO Name |
| %ACCOUNT_NAME% | Group Name | Group Name |
| %GROUP_SCOPE% | Group Scope | Scope of Group(Local/ Global/Universal) |
| %GROUP_TYPE% | Group Type | Type of Group(security/Distribution) |
| %SYSTEM_HEALTH_VALIDATOR_RESULT% | Health Validator Result | Health Validator Result In NPS |
| %HELP_URL% | Help URL | Help URL |
| %HOME_DIRECTORY% | Home Directory | Users Home Directory Path |
| %HOME_DRIVE% | Home Drive | Users Home Drive |
| %OEM_INFO% | Information | OEM Information in Integer |
| %FILE_LOCATION% | Location | Location of the file/Folder |
| %TIME_GENERATED% | Locked out Time | Locked out Time |
| %LOCKOUT_DURATION% | LockOut Duration | Duration of Account getting Lockedout |
| %LOCKOUT_OBSERV_WINDOW% | LockOut Observation Window | LockOut Observation Window |
| %LOCKOUT_THRESHOLD% | LockOut Threshold | Lockout thershold |
| %LOGON_ID% | Login ID | Logged in Sessions ID for a User |
| %TIME_GENERATED% | Logoff Time | Logoff Time |
| %LOGON_TYPE% | Logon Code | Type of logon in Integer Format |
| %LOGON_HOURS% | Logon Hours | Duration Of Logon |
| %LOGON_PROCESS% | Logon Process | Logon process in String |
| %LOGON_SERVICE% | Logon Service | Logon Service |
| %TIME_GENERATED% | Logon Time | Logon Time |
| %LOGON_TYPE_TEXT% | Logon Type | Type of logon in Text Format |
| %LOGON_TO% | Logon Workstation | Where the User has Logged in |
| %LOGON_TO% | Logon Workstations | Where the User has Logged in |
| %FORMAT_MESSAGE% | Message | General Description by ADAudit Plus with Necessary Information |
| %ACCESSES% | Modification Type | Operation performed by users |
| %COMP_MGMT_TYPE% | Modification Type | Compter Modification Type |
| %GROUP_MGMT_TYPE% | Modification Type | Group Modification Type |
| %USER_MGMT_TYPE% | Modification Type | User Modification Type |
| %ATTRIBUTES_TEXT% | Modified Attributes | Modified Attributes |
| %USER_MGMT_TYPE% | Modified Attributes | Attributes Modified in User Object |
| %USERNAME% | Modified by | Name of the User who made the action |
| %TIME_GENERATED% | Modified Time | Modified Time |
| %CALLER_CANONICAL_NAME% | Name | Canonical Name |
| %NAS_IDENTIFIER% | NAS Identifier | NAS Identifier Network policy server |
| %NAS_IPV4_ADDRESS% | NAS IPv4 Address | Ip Address |
| %NAS_IPV6_ADDRESS% | NAS IPv6 Address | Ip Address |
| %NAS_PORT% | NAS Port | Port number |
| %NAS_PORT_TYPE% | NAS Port Type | NAS Port Type |
| %NETWORK_POLICY_NAME% | Network Policy Name | Name of the Network Policy in NPS report |
| %ACCOUNT_DOMAIN% | New account Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New Account Name | User Name |
| %ACCOUNT_SID% | New Account SID | Object SID string |
| %ACCOUNT_DOMAIN% | New Computer Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New Computer Name | Computer Name |
| %ADDITIONAL_INFO% | New GPO Distinguished Name | Distinguished Name |
| %ADDITIONAL_INFO2_TEXT% | New GPO Name | GPO or OU Name |
| %ACCOUNT_DOMAIN% | New Group Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New Group Name | Group Name |
| %ADDITIONAL_INFO% | New OU Distinguished Name | Distinguished Name |
| %ADDITIONAL_INFO2_TEXT% | New OU Name | GPO or OU Name |
| %NEW_PERMISSIONS% | New Permission | Added Permissions |
| %NEW_TIME% | New Time | New Changed system time by User |
| %NEW_UAC_VALUE% | New User account control Value | New UAC Value |
| %ACCOUNT_DOMAIN% | New User Domain | Actual Domain Name |
| %ACCOUNT_NAME% | New User Name | User Name |
| %NOTIFICATION_PACKAGE_NAME% | Notification Package Name | Notification Package Name |
| %OBJECT_CLASS% | Object Class | Object Class |
| %OBJECT_CLASS_TEXT% | Object Class | Object Class |
| %OBJECT_TYPE_TEXT% | Object Class | Object Type in Text (OU, Container) |
| %OBJECT_NAME_TEXT% | Object Name | OU/GPO Name |
| %OBJECT_SERVER% | Object Server | Object Server like DS/AD Domain Services |
| %OBJECT_TYPE% | Object Type | Object Type like File or Folder |
| %OLD_ACCOUNT_NAME% | Old Computer Name | Old Computer Name |
| %OLD_ACCOUNT_NAME% | Old Group Name | Old Group Name |
| %OLD_UAC_VALUE% | Old User account control Value | Old User account control Value |
| %OLD_ACCOUNT_NAME% | Old User Name | Old User Name |
| %ORIGINAL_PERMISSIONS% | Original Permission | Original Permission |
| %OS_VERSION% | OS Version | OS Version |
| %OBJECT_NAME% | OU Distinguished Name | OU Name |
| %OBJECT_NAME_TEXT% | OU Name | OU Name |
| %OBJECT_LOCATION_TEXT% | Parent Object | OU Parent Location |
| %OBJECT_TYPE_TEXT% | Parent Object Class | Object Type in Text (OU, Container) |
| %OBJECT_NAME_TEXT% | Parent Object Name | OU Parent Location |
| %PASSWORD_HIST_LENGTH% | Password History Length | Password History Length |
| %PWD_LAST_SET% | Password Last Set | Password Last Set |
| %PASSWORD_PROP% | Password Property | Password Complextity |
| %ACL_CHANGE% | Permission modified | Permission Changes |
| %PREVIOUS_TIME% | Previous Time | Previous Time |
| %PRIMARY_DOMAIN% | Primary Domain | Domain Name |
| %PRIMARY_USER_NAME% | Primary User Name | Primary User Name |
| %PRIVILEGES% | Privileges | Privileges |
| %PRIVILEGES_USED% | Privileges Used | Privileges Used |
| %PROCESS_NAME% | Process Name | Process Name |
| %PROFILE_PATH% | Profile Path | Profile Path |
| %RESTRICTED_SID_COUNT% | Restricted SID Count | count of SID Resticted |
| %CLIENT_HOST_NAME% | Radius Client Host Name | Name Of the Client Machine |
| %CLIENT_MC_NAME% | Radius Client IP Address | Ip Address of the Client Machine |
| %USER_RIGHTS_VALUE% | Removed Rights | User Rights Removed |
| %SAM_ACCOUNT_NAME% | SAM Account Name | SAM Account Name |
| %SCRIPT_PATH% | Script Path | Script Path of the User Object |
| %SOURCE% | Server | Source Server Where the User Perfoms Logon |
| %SERVICE_PRINCIPAL_NAME% | Service Principal Name | Service Principal Name |
| %ACCOUNT_SID% | SID | Object SID string |
| %CALLER_USER_SID% | SID | SID of the User who made the action |
| %USER_SID% | SID | SID of the User |
| %SID_HISTORY% | SID History | History of SID |
| %SOURCE_PORT% | Source Port | Port number |
| %OBJECT_CLASS_TEXT% | Target Object Class | Object Class Text like User,Group,Computer,OU&GPO |
| %TIME_GENERATED% | Time Accessed | Accesed Time |
| %TIME_GENERATED% | Time Deleted | Time of the Deletion |
| %TIME_GENERATED% | Time Modified | Time of the Modification |
| %USER_ACCOUNT_CONTROL% | User account control | User account control |
| %ACCOUNT_NAME% | User Name | User Name |
| %CALLER_USER_NAME% | User Name | Name of the User who made the action |
| %USERNAME% | User Name | User Name Windows 2003 |
| %USER_PRINCIPAL_NAME% | User Principal Name | User Principal Name |
| %USER_RIGHTS% | User Rights | User Rights |
| %USER_SID% | User SID | SID Of the user |
| %USERNAME% | USERNAME | User Name Windows 2003 |
| %TIME_GENERATED% | When | Time Generated |
| %SOURCE% | Where | Source Workstation Where the User Perfoms Logon |
| %CLIENT_USER_NAME% | Who changed | Name of the User who made the action |
| %CLIENT_USER_NAME% | Who Created | Name of the User who made the action |
| %CLIENT_USER_NAME% | Who deleted | Name of the User who made the action |
| %SOURCE% | Workstation Name | Source Workstation Where the User Perfoms Logon |