New_ID-2^12=?

It is funny and useful IMHO. New event IDs from Security Event Log in Vista appear to have theirs analogs in more old systems (no wonder, actually), but they are away from those exactly by 4096.

It is described why it was done here. In short, great changes were introduced into the content of the events, so there was a need to distinguish between pre-Vista and Vista events. Now as in the source code numbers are represented as hex values they added not 5000 or 6000, but 0x1000=4096

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s