Alert Message Variables
Variable Display Name Description
%FORMAT_MESSAGE% Description General description by ADAudit Plus with necessary information
%OBJECT_NAME% Absolute Name Full name of the Object
%ACCESS_MASK% Access Mask Operation performed by users in integer format
%USERNAME% Accessed by Who accesed the operation(File , Folder)
%ACCESSES% Accesses Operation performed by users
%ACCOUNT_DOMAIN% Account Domain Actual Domain Name
%ACCOUNT_EXPIRY_DATE% Account Expiry Date Expiry date of An Account
%ACCOUNT_NAME% Account Name User Name
%ACCOUNT_SESSION_IDENTIFIER% Account Session Identifier Logon Session ID
%ACCOUNT_SID% Account SID Object SID string
%ACCOUNT_EXPIRY_DATE% Account Expiry Date Expiry date of An Account
%OBJECT_NAME% Absolute Name Full name of the Object
%USERNAME% Accessed by Who accesed the operation(File , Folder)
%ACCESSES% Accesses Operation performed by users
%ACCESS_TYPE% Access Type Type of operation in number
%ACCESS_TYPE_TEXT% Access Type Type of operation in text
%ACCOUNT_DOMAIN% Account Domain Actual Domain Name
%ACCOUNT_EXPIRY_DATE% Account Expiry Date Expiry date of An Account
%ACCOUNT_NAME% Account Name User Name
%ACCOUNT_SESSION_IDENTIFIER% Account Session Identifier Logon Session ID
%ACCOUNT_SID% Account SID Object SID string
%ACTION% Action Operation type
%ALERT_ID% Alert Id Alert Id
%ALERT_MESSAGE% Alert Message Value in the Alert Message
%ALLOWED_TO_DELEGATE_TO% Allowed to delegate to
%APPLICATION_NAME% Application Name File Name
%APPLIES_TO% Applies to Permissions applies
%USER_RIGHTS_VALUE% Assigned Rights Rights Assigned to User
%ATTRIBUTES_TEXT% Attributes Text Modified Attributes
%ATTRIBUTES_NEW_VALUE% New Value Change in Attribute New Value
%ATTRIBUTES_OLD_VALUE% Old Value Change in Attribute Old Value
%AUTHENTICATION_PACKAGE% Authentication Package Type of Authentication Name
%AUTHENTICATION_PACKAGE_NAME% Authentication Package Name Type of Authentication Name
%AUTHENTICATION_PROVIDER% Authentication Provider Type of Authentication Provider
%AUTHENTICATION_SERVER% Authentication Server Server Where the Audthentication happened
%AUTHENTICATION_TYPE% Authentication Type Method of Authentication
%CALLED_STATION% Called Station NPS Called station(Where to)
%CALLER_LOGON_ID% Caller Logon ID Login ID
%CALLER_MACHINE_NAME% Caller Machine Name Machine Name of the User
%CALLER_USER_DOMAIN% Caller User Domain Domain Name
%CALLER_USER_NAME% Caller User Name Name of the User who made the action
%CALLER_LOGON_ID% Caller User SID User SID
%CALLER_USER_SID% Caller User SID SID of the User who made the action
%CALLING_STATION% Calling Station NPS Calling station(from where)
%CHANGE_TYPE_TEXT% Change Type Type of Change in Text format (Added/Removed/Modified)
%MODIFICATION_TYPE% Change Type Type of Modification
%CLIENT_DOMAIN% Client Domain Domain Name
%CLIENT_HOST_NAME% Client Host Name Name Of the Client Machine
%CLIENT_MC_NAME% Client IP Address Ip Address of the Client Machine
%CLIENT_LOGIN_ID% Client Login ID Login ID
%CLIENT_HOST_NAME% Client Machine Name Name Of the Client Machine
%CLIENT_USER_NAME% Client User Name Name of the User who made the action
%COMMENT_NEW_VALUE% Comment New Value New Value
%COMMENT_OLD_VALUE% Comment Old value Old Value
%ACCOUNT_NAME% Computer Name Computer Name
%USERNAME% Created by Name of the User who made the action
%EVENT_TYPE% Creation Status Type of the event in integer(8 or 16)
%EVENT_TYPE_TEXT% Creation Status Code Type of the event in string
%TIME_GENERATED% Creation Time Creation Time
%USERNAME% Deleted by Name of the User who made the action
%TIME_GENERATED% Deleted Time Deleted Time
%DISPLAY_NAME% Display Name Display Name
%DNS_HOST_NAME% DNS Host Name DNS Host Name
%ACCOUNT_DOMAIN% Domain Actual Domain Name
%CALLER_USER_DOMAIN% Domain Domain Name
%DOMAIN% Domain Domain Name
%DOMAIN_NAME% Domain Domain Name
%SOURCE% Domain Controller Source Domain Controller Where the User Perfoms Logon
%EAP_TYPE% EAP Type Extension Authentication protocol type
%EVENT_TYPE% Event Code Type of the event in integer(8 or 16)
%TIME_PERIOD% Event Fetch Interval Event Fetch Interval
%EVENT_NUMBER% Event Number Event Number
%EVENT_TYPE% Event Type Type of the event in integer(8 or 16)
%EVENT_TYPE_TEXT% Event Type Type of the event in string
%EVENT_TYPE% Event Type Code Type of the event in integer(8 or 16)
%EVENT_TYPE_TEXT% Event Type Text Type of the event in string
%EXTENDED_RESULT% Extended Result Extended Result for NPS logon
%ERROR_CODE% Failure Code Failure reason in hexadecimal format
%ERROR_CODE_TEXT% Failure Reason Failure reason in Text
%ERROR_CODE% Failure Type Failure reason in hexadecimal format
%ERROR_CODE_TEXT% Failure Type Failure reason in Text
%FILE_NAME% File / Folder Name Name Of the File/ Folder
%APPLICATION_NAME% File Name File Name
%FILE_NAME% File Name Name Of the File/ Folder
%PROCESS_NAME% File Name Name Of the File
%NAME% File Server Name Name of the File Server
%FORCE_LOGOFF% Force Logoff Force Log-off
%CANONICAL_NAME% Full Account Name Canonical Name
%OBJECT_NAME% GPO Distinguished Name Full name of the GPO
%OBJECT_GUID% GPO Name GPO Name
%OBJECT_NAME_TEXT% GPO Name GPO Name
%ACCOUNT_NAME% Group Name Group Name
%GROUP_SCOPE% Group Scope Scope of Group(Local/ Global/Universal)
%GROUP_TYPE% Group Type Type of Group(security/Distribution)
%SYSTEM_HEALTH_VALIDATOR_RESULT% Health Validator Result Health Validator Result In NPS
%HELP_URL% Help URL Help URL
%HOME_DIRECTORY% Home Directory Users Home Directory Path
%HOME_DRIVE% Home Drive Users Home Drive
%OEM_INFO% Information OEM Information in Integer
%FILE_LOCATION% Location Location of the file/Folder
%TIME_GENERATED% Lockedout Time Lockedout Time
%TIME_GENERATED% Locked out Time Locked out Time
%LOCKOUT_DURATION% LockOut Duration Duration of Account getting Lockedout
%LOCKOUT_OBSERV_WINDOW% LockOut Observation Window Time When the System is Logged off
%LOCKOUT_THRESHOLD% LockOut Threshold Lockout thershold
%LOGON_ID% Login ID Logged in Sessions ID for a User
%LOGOFF_TIME% Logoff Time Time When the System is Logged off
%TIME_GENERATED% Logoff Time Logoff Time
%LOGON_TYPE% Logon Code Type of logon in Integer Format
%LOGON_HOURS% Logon Hours Duration Of Logon
%LOGON_PROCESS% Logon Process Logon process in String
%LOGON_PROCESS_NAME% Logon Process Name Logon Process Name
%LOGON_SERVICE% Logon Service Logon Service
%LOGON_TIME% Logon Time Time When the System is Logged in
%TIME_GENERATED% Logon Time Logon Time
%LOGON_TYPE_TEXT% Logon Type Type of logon in Text Format
%LOGON_TO% Logon Workstation Where the User has Logged in
%MAX_PASSWORD_AGE% Maximum Password Age Maximum Password Age
%MEMBER_NAME% Member Name Name of the Member from a Group
%NAME% Member Server Name Name of the Member Server
%MEMBER_SID% Member SID SID of the Member
%FORMAT_MESSAGE% Message General Description by ADAudit Plus with Necessary Information
%MIN_PASSWORD_AGE% Minimum Password Age Minimum Password Age
%MIN_PASSWORD_LENGTH% Minimum Password Length Minimum Password Length
%MIXED_DOMAIN_MODE% Mixed Domain Mode Mixed Domain Mode
%COMP_MGMT_TYPE% Modification Type Compter Modification Type
%GROUP_MGMT_TYPE% Modification Type Group Modification Type
%USER_MGMT_TYPE% Modification Type User Modification Type
%ATTRIBUTES_TEXT% Modified Attributes Modified Attributes
%USER_MGMT_TYPE% Modified Attributes Attributes Modified in User Object
%CALLER_USER_NAME% Modified by Name of the User who made the action
%USERNAME% Modified by Name of the User who made the action
%MODIFIED_PROPS% Modified Properties Modified properties of a User Object
%TIME_GENERATED% Modified Time Modified Time
%CALLER_CANONICAL_NAME% Name Canonical Name
%NAS_IDENTIFIER% NAS Identifier NAS Identifier Network policy server
%NAS_IPV4_ADDRESS% NAS IPv4 Address Ip Address
%NAS_IPV6_ADDRESS% NAS IPv6 Address Ip Address
%NAS_PORT% NAS Port Port number
%NAS_PORT_TYPE% NAS Port Type NAS Port Type
%NETWORK_POLICY_NAME% Network Policy Name Name of the Network Policy in NPS report
%ACCOUNT_DOMAIN% New Account Domain Actual Domain Name
%ACCOUNT_NAME% New Account Name User Name
%ACCOUNT_DOMAIN% New Computer Domain Actual Domain Name
%ACCOUNT_NAME% New Computer Name Computer Name
%ADDITIONAL_INFO% New GPO Distinguished Name Distinguished Name
%ADDITIONAL_INFO2_TEXT% New GPO Name GPO or OU Name
%ACCOUNT_DOMAIN% New Group Domain Actual Domain Name
%ACCOUNT_NAME% New Group Name Group Name
%ADDITIONAL_INFO% New OU Distinguished Name Distinguished Name
%ADDITIONAL_INFO2_TEXT% New OU Name GPO or OU Name
%NEW_PERMISSIONS% New Permission Added Permissions
%NEW_SEC_DESC% New Permission New Security Descriptions
%NEW_TIME% New Time New Changed system time by User
%NEW_UAC_VALUE% New UAC Value New UAC Value
%NEW_UAC_VALUE% New User Account Control Value New UAC Value
%ACCOUNT_DOMAIN% New User Domain Actual Domain Name
%ACCOUNT_NAME% New User Name User Name
%ATTRIBUTES_NEW_VALUE% New value Change in Attribute New Value
%SETTING_NEW_VALUE% New value New value
%NOTIFICATION_PACKAGE_NAME% Notification Package Name Notification Package Name
%OBJECT_CLASS% Object Class Object Class
%OBJECT_CLASS_TEXT% Object Class Object Class Text
%OBJECT_TYPE_TEXT% Object Class Object Type in Text (OU, Container)
%OBJECT_NAME_TEXT% Object Name Object class Text
%OBJECT_SERVER% Object Server Object Server like Security
%OBJECT_TYPE% Object Type Object Type like File or Folder
%OLD_ACCOUNT_NAME% Old Computer Name Old Computer Name
%OLD_ACCOUNT_NAME% Old Group Name Old Group Name
%OLD_UAC_VALUE% Old UAC Value Old UAC Value
%OLD_UAC_VALUE% Old User Account Control Value Old User Account Control Value
%OLD_ACCOUNT_NAME% Old User Name Old User Name
%ATTRIBUTES_OLD_VALUE% Old Value Change in Attribute Old Value
%SETTING_OLD_VALUE% Old Value Old Value
%ORIGINAL_PERMISSIONS% Original Permission Original Permission
%ORIGINAL_SEC_DESC% Original Permission Original Permission
%OS_VERSION% OS Version OS Version
%OBJECT_NAME% OU Distinguished Name OU Name
%OBJECT_NAME_TEXT% OU Name OU Name
%OBJECT_LOCATION_TEXT% Parent Object OU Parent Location
%OBJECT_TYPE_TEXT% Parent Object Class Object Type in Text (OU, Container)
%OBJECT_NAME_TEXT% Parent Object Name OU Parent Location
%PASSWORD_HIST_LENGTH% Password History Length Password History Length
%PWD_LAST_SET% Password Last Set Password Last Set
%PASSWORD_PROP% Password Property Password Complextity
%PERMISSION% Permission Current Permission
%ACL_CHANGE% Permission modified Permission Changes
%POLICY_CATEGORY% Policy Category Policy Category
%POLICY_CHANGES% Policy Changes Policy Changes
%POLICY_PATH% Policy Path Path Of the Policy located
%POLICY_SUB_CATEGORY% Policy Sub Category Sub Category of the Policy
%PREVIOUS_TIME% Previous Time Previous Time
%PRIMARY_DOMAIN% Primary Domain Domain Name
%PRIMARY_USER_NAME% Primary User Name User Name
%PRIVILEGES% Privileges Privileges
%PRIVILEGES_USED% Privileges Used Privileges Used
%PROCESS_NAME% Process Name Process Name
%PROFILE_PATH% Profile Path Profile Path
%QUARANTINE_GRACE_TIME% Quarantine Grace Time Quarantine Grace Time in NPS server
%CLIENT_HOST_NAME% Radius Client Host Name Name Of the Client Machine
%CLIENT_MC_NAME% Radius Client IP Address Ip Address of the Client Machine
%QUARANTINE_GRACE_TIME% Quarantine Grace Time Quarantine Grace Time in NPS server
%REASON% Reason Reason in Text format
%REASON_CODE% Reason Code Reason in integer format
%RECORD_NUMBER% Record Number Record Number
%USER_RIGHTS_VALUE% Removed Rights User Rights Removed
%REMARKS% Remarks Default message
%REQUEST_POLICY_NAME% Request Policy Name Policy Name
%USER_RIGHTS% Rights User Rights
%USER_RIGHTS_VALUE% Rights Value User Rights Value
%SAM_ACCOUNT_NAME% SAM Account Name SAM Account Name
%SCRIPT_PATH% Script Path Script Path of the User Object
%SECURITY_PRINCIPAL% Security Principal Security Principal
%SOURCE% Server Source Server Where the User Perfoms Logon
%SERVICE_PRINCIPAL_NAME% Service Principal Name Service Principal Name
%SETTING_NAME% Setting Name Name of Policy Settings
%ACCOUNT_SID% SID Object SID string
%CALLER_USER_SID% SID SID of the User who made the action
%USER_SID% SID SID of the User
%SID_HISTORY% SID History History of SID
%SOURCE% Source Source Workstation Where the User Perfoms Logon
%SOURCE% Source Computer Source Workstation Where the User Perfoms Logon
%SOURCE_PORT% Source Port Port number
%MESSAGE% Status General Description by ADAudit Plus with Necessary Information
%TERMINATED_TIME% Terminated Time Terminated Time
%TIME_GENERATED% Time Time Generated
%TIME_GENERATED% Time Accessed Accesed Time
%TIME_GENERATED% Time created Time of the creation
%TIME_GENERATED% Time Deleted Time of the Deletion
%CREATION_TIME% Time Generated Time When created
%TIME_GENERATED% Time Modified Time of the Modification
%ACE_TYPE% Type Permission Type
%UNC_NAME% UNC Name UNC Name
%USER_ACCOUNT_CONTROL% User Account Control User Account Control
%ACCOUNT_NAME% User Name User Name
%CALLER_USER_NAME% User Name Name of the User who made the action
%USERNAME% User Name User Name Windows 2003
%USER_PRINCIPAL_NAME% User Principal Name User Principal Name
%USER_RIGHTS% User Rights User Rights in Value
%USER_SID% User SID SID Of the user
%TIME_GENERATED% When Time Generated
%SOURCE% Where Source Workstation Where the User Perfoms Logon
%CLIENT_USER_NAME% Who changed Name of the User who made the action
%CLIENT_USER_NAME% Who Created Name of the User who made the action
%CLIENT_USER_NAME% Who deleted Name of the User who made the action
%CLIENT_USER_NAME% Who Modified Name of the User who made the action
%SOURCE% Workstation Name Source Workstation Where the User Perfoms Logon
%EVENT_TYPE% Event Code Type of the event in integer(8 or 16)
%NEW_UAC_VALUE% New User account control Value New UAC Value
%ALLOWED_TO_DELEGATE_TO% Allowed to delegate to
%USER_RIGHTS_VALUE% Assigned Rights Rights Assigned to User
%AUTHENTICATION_PACKAGE% Authentication Package Type of Authentication Name
%AUTHENTICATION_PROVIDER% Authentication Provider Type of Authentication Provider
%AUTHENTICATION_SERVER% Authentication Server Server Where the Audthentication happened
%AUTHENTICATION_TYPE% Authentication Type Method of Authentication
%CALLED_STATION% Called Station NPS Called station(Where to)
%CALLER_LOGON_ID% Caller Logon ID Login ID
%CALLER_MACHINE_NAME% Caller Machine Name Machine Name of the User
%CALLER_USER_DOMAIN% Caller User Domain Domain Name
%CALLER_USER_NAME% Caller User Name Name of the User who made the action
%CALLER_LOGON_ID% Caller User SID User SID
%CALLER_USER_SID% Caller User SID SID of the User who made the action
%CALLING_STATION% Calling Station NPS Calling station(from where)
%CLIENT_DOMAIN% Client Domain Domain Name
%CLIENT_HOST_NAME% Client Host Name Name Of the Client Machine
%CLIENT_MC_NAME% Client IP Address Ip Address of the Client Machine
%CLIENT_LOGIN_ID% Client Login ID Login ID
%CLIENT_HOST_NAME% Client Machine Name Name Of the Client Machine
%CLIENT_USER_NAME% Client User Name Name of the User who made the action
%ACCOUNT_NAME% Computer Name Computer Name
%TIME_GENERATED% Creation Time Creation Time
%USERNAME% Deleted by Name of the User who made the action
%TIME_GENERATED% Deleted Time Deleted Time
%DISPLAY_NAME% Display Name Display Name
%DNS_HOST_NAME% DNS Host Name DNS Host Name
%ACCOUNT_DOMAIN% Domain Actual Domain Name
%CALLER_USER_DOMAIN% Domain Domain Name
%DOMAIN% Domain Domain Name
%SOURCE% Domain Controller Source Domain Controller Where the User Perfoms Logon
%EAP_TYPE% EAP Type Extension Authentication protocol type
%EVENT_TYPE% Event Code Type of the event in integer(8 or 16)
%EVENT_NUMBER% Event Number Event Number
%EVENT_TYPE% Event Type Type of the event in integer(8 or 16)
%EVENT_TYPE_TEXT% Event Type Type of the event in string
%EVENT_TYPE% Event Type Code Type of the event in integer(8 or 16)
%EVENT_TYPE_TEXT% Event Type Text Type of the event in string
%EVENT_TYPE_TEXT% EVENT_TYPE_TEXT Type of the event in string
%EXTENDED_RESULT% Extended Result Extended Result for NPS logon
%ERROR_CODE% Failure Code Failure reason in hexadecimal format
%ERROR_CODE_TEXT% Failure Reason Failure reason in Text
%ERROR_CODE_TEXT% Failure Type Failure reason in Text
%FILE_NAME% File / Folder Name Name Of the File/ Folder
%APPLICATION_NAME% File Name File Name
%PROCESS_NAME% File Name Name Of the File
%FORCE_LOGOFF% Force Logoff Force Log-off
%CANONICAL_NAME% Full Account Name Canonical Name
%OBJECT_NAME% GPO Distinguished Name GPO Name
%OBJECT_NAME_TEXT% GPO Name GPO Name
%ACCOUNT_NAME% Group Name Group Name
%GROUP_SCOPE% Group Scope Scope of Group(Local/ Global/Universal)
%GROUP_TYPE% Group Type Type of Group(security/Distribution)
%SYSTEM_HEALTH_VALIDATOR_RESULT% Health Validator Result Health Validator Result In NPS
%HELP_URL% Help URL Help URL
%HOME_DIRECTORY% Home Directory Users Home Directory Path
%HOME_DRIVE% Home Drive Users Home Drive
%OEM_INFO% Information OEM Information in Integer
%FILE_LOCATION% Location Location of the file/Folder
%TIME_GENERATED% Locked out Time Locked out Time
%LOCKOUT_DURATION% LockOut Duration Duration of Account getting Lockedout
%LOCKOUT_OBSERV_WINDOW% LockOut Observation Window LockOut Observation Window
%LOCKOUT_THRESHOLD% LockOut Threshold Lockout thershold
%LOGON_ID% Login ID Logged in Sessions ID for a User
%TIME_GENERATED% Logoff Time Logoff Time
%LOGON_TYPE% Logon Code Type of logon in Integer Format
%LOGON_HOURS% Logon Hours Duration Of Logon
%LOGON_PROCESS% Logon Process Logon process in String
%LOGON_SERVICE% Logon Service Logon Service
%TIME_GENERATED% Logon Time Logon Time
%LOGON_TYPE_TEXT% Logon Type Type of logon in Text Format
%LOGON_TO% Logon Workstation Where the User has Logged in
%LOGON_TO% Logon Workstations Where the User has Logged in
%FORMAT_MESSAGE% Message General Description by ADAudit Plus with Necessary Information
%ACCESSES% Modification Type Operation performed by users
%COMP_MGMT_TYPE% Modification Type Compter Modification Type
%GROUP_MGMT_TYPE% Modification Type Group Modification Type
%USER_MGMT_TYPE% Modification Type User Modification Type
%ATTRIBUTES_TEXT% Modified Attributes Modified Attributes
%USER_MGMT_TYPE% Modified Attributes Attributes Modified in User Object
%USERNAME% Modified by Name of the User who made the action
%TIME_GENERATED% Modified Time Modified Time
%CALLER_CANONICAL_NAME% Name Canonical Name
%NAS_IDENTIFIER% NAS Identifier NAS Identifier Network policy server
%NAS_IPV4_ADDRESS% NAS IPv4 Address Ip Address
%NAS_IPV6_ADDRESS% NAS IPv6 Address Ip Address
%NAS_PORT% NAS Port Port number
%NAS_PORT_TYPE% NAS Port Type NAS Port Type
%NETWORK_POLICY_NAME% Network Policy Name Name of the Network Policy in NPS report
%ACCOUNT_DOMAIN% New account Domain Actual Domain Name
%ACCOUNT_NAME% New Account Name User Name
%ACCOUNT_SID% New Account SID Object SID string
%ACCOUNT_DOMAIN% New Computer Domain Actual Domain Name
%ACCOUNT_NAME% New Computer Name Computer Name
%ADDITIONAL_INFO% New GPO Distinguished Name Distinguished Name
%ADDITIONAL_INFO2_TEXT% New GPO Name GPO or OU Name
%ACCOUNT_DOMAIN% New Group Domain Actual Domain Name
%ACCOUNT_NAME% New Group Name Group Name
%ADDITIONAL_INFO% New OU Distinguished Name Distinguished Name
%ADDITIONAL_INFO2_TEXT% New OU Name GPO or OU Name
%NEW_PERMISSIONS% New Permission Added Permissions
%NEW_TIME% New Time New Changed system time by User
%NEW_UAC_VALUE% New User account control Value New UAC Value
%ACCOUNT_DOMAIN% New User Domain Actual Domain Name
%ACCOUNT_NAME% New User Name User Name
%NOTIFICATION_PACKAGE_NAME% Notification Package Name Notification Package Name
%OBJECT_CLASS% Object Class Object Class
%OBJECT_CLASS_TEXT% Object Class Object Class
%OBJECT_TYPE_TEXT% Object Class Object Type in Text (OU, Container)
%OBJECT_NAME_TEXT% Object Name OU/GPO Name
%OBJECT_SERVER% Object Server Object Server like DS/AD Domain Services
%OBJECT_TYPE% Object Type Object Type like File or Folder
%OLD_ACCOUNT_NAME% Old Computer Name Old Computer Name
%OLD_ACCOUNT_NAME% Old Group Name Old Group Name
%OLD_UAC_VALUE% Old User account control Value Old User account control Value
%OLD_ACCOUNT_NAME% Old User Name Old User Name
%ORIGINAL_PERMISSIONS% Original Permission Original Permission
%OS_VERSION% OS Version OS Version
%OBJECT_NAME% OU Distinguished Name OU Name
%OBJECT_NAME_TEXT% OU Name OU Name
%OBJECT_LOCATION_TEXT% Parent Object OU Parent Location
%OBJECT_TYPE_TEXT% Parent Object Class Object Type in Text (OU, Container)
%OBJECT_NAME_TEXT% Parent Object Name OU Parent Location
%PASSWORD_HIST_LENGTH% Password History Length Password History Length
%PWD_LAST_SET% Password Last Set Password Last Set
%PASSWORD_PROP% Password Property Password Complextity
%ACL_CHANGE% Permission modified Permission Changes
%PREVIOUS_TIME% Previous Time Previous Time
%PRIMARY_DOMAIN% Primary Domain Domain Name
%PRIMARY_USER_NAME% Primary User Name Primary User Name
%PRIVILEGES% Privileges Privileges
%PRIVILEGES_USED% Privileges Used Privileges Used
%PROCESS_NAME% Process Name Process Name
%PROFILE_PATH% Profile Path Profile Path
%RESTRICTED_SID_COUNT% Restricted SID Count count of SID Resticted
%CLIENT_HOST_NAME% Radius Client Host Name Name Of the Client Machine
%CLIENT_MC_NAME% Radius Client IP Address Ip Address of the Client Machine
%USER_RIGHTS_VALUE% Removed Rights User Rights Removed
%SAM_ACCOUNT_NAME% SAM Account Name SAM Account Name
%SCRIPT_PATH% Script Path Script Path of the User Object
%SOURCE% Server Source Server Where the User Perfoms Logon
%SERVICE_PRINCIPAL_NAME% Service Principal Name Service Principal Name
%ACCOUNT_SID% SID Object SID string
%CALLER_USER_SID% SID SID of the User who made the action
%USER_SID% SID SID of the User
%SID_HISTORY% SID History History of SID
%SOURCE_PORT% Source Port Port number
%OBJECT_CLASS_TEXT% Target Object Class Object Class Text like User,Group,Computer,OU&GPO
%TIME_GENERATED% Time Accessed Accesed Time
%TIME_GENERATED% Time Deleted Time of the Deletion
%TIME_GENERATED% Time Modified Time of the Modification
%USER_ACCOUNT_CONTROL% User account control User account control
%ACCOUNT_NAME% User Name User Name
%CALLER_USER_NAME% User Name Name of the User who made the action
%USERNAME% User Name User Name Windows 2003
%USER_PRINCIPAL_NAME% User Principal Name User Principal Name
%USER_RIGHTS% User Rights User Rights
%USER_SID% User SID SID Of the user
%USERNAME% USERNAME User Name Windows 2003
%TIME_GENERATED% When Time Generated
%SOURCE% Where Source Workstation Where the User Perfoms Logon
%CLIENT_USER_NAME% Who changed Name of the User who made the action
%CLIENT_USER_NAME% Who Created Name of the User who made the action
%CLIENT_USER_NAME% Who deleted Name of the User who made the action
%SOURCE% Workstation Name Source Workstation Where the User Perfoms Logon

Get download link