How to capture user & computer details of an specific event ID from Event Viewer?

Usage and Config Platform
1

How to capture user & computer details of an specific event ID from Event Viewer ?

q: descriptions of records whose (event id of it = 1033 AND source of it = “MsiInstaller” AND description of it contains “success or error”) of application event log
A: Windows Installer installed the product. Product Name: SDK ARM Redistributables. Product Version: 10.1.18362.1. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0.

Here, I am not able to capture System & User details, need support on adding this into this relevance.

Required Fields : Users & Computer
Users- ITTeam/SAM
Computer- SAM_PATRO

2

Does this include the info you need?

(computer of it, user sids of it, descriptions of it) of records whose (event id of it = 1033 AND source of it = "MsiInstaller" AND description of it contains "success or error") of application event log

3 Likes
3

@SLB
Thanks You Sir.