I'm working on output analysis of the Windows Event ID 5136 ("A directory service object was modified") and more specifically events with "LDAP Display Name = nTSecurityDescriptor" (see following event 5136 capture).
In the "value" field, I have a list of all the security permissions changed on the object itself, which is great. However, I notice the following problems when trying to compare 2x correlated events and their respective "values" fields:
- Number of characters is always 5120 (4096+1024)
- Text located in the last line is always truncated, and doesn't finish with the proper character - should be a ")" at the end (see folllwing text output).
Information about the events:
- Source host is a Windows Server 2012 R2 DC (up to date)
- For this specific output analysis, logs were directly extracted from the source computer itself (so no WEF, NXlog Agent, SYSLOG, ELK, SIEM, ...)
- Viewing the event with PowerShell, Event console (general tab) or Event console (Details/XML View) provide the same output
So I looked for some value size limitations inside Windows Events (not the event log file itself) but just found some info on "community embarcadero" and "developpez" websites.
Question: does someone know if there is any limitation for a Windows logs value field to 5120 Bytes and a way to increase it ? I need both to make a diff between and report the changes. Thanks
