# Winlogbeat Evt 4741 4742 4743 - Computer Management Events **URL:** \ **Category:** Beats\ **Created:** [October 31, 2019, 3:23pm UTC](https://discuss.elastic.co/t/winlogbeat-evt-4741-4742-4743-computer-management-events/206069 "2019-10-31T15:23:32Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Anabella\_Cristaldi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anabella_cristaldi/32/23612_2.png) [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Post date:** [October 31, 2019, 3:23pm UTC](https://discuss.elastic.co/t/winlogbeat-evt-4741-4742-4743-computer-management-events/206069/1 "2019-10-31T15:23:32Z")
Hi, I'm working now with Events related to creation, changing and deletion of computers in windows Active directory. In these events the fields TargetUserSID, TargetUserName and TargetDomainName represents the SID,Name and Domain of the computer (object) being created, modified or deleted. When I analyze the events I thought that mapping these fields to ECS host.id, host.name and host.domain ([https://github.com/elastic/ecs/pull/591](https://github.com/elastic/ecs/pull/591)) was a the way to go. But then I realize that the host.\* fields are used and mapped in all the other cases with the source host of the events and therefore is not a good idea to use the host.\* fields in this case. Should be better to use an specific winlog fields? For example: winlog.computer.id, winlog.computer.name and winlog.computer.name? What do you think? Thank you Regards Ana ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2019, 5:23pm UTC](https://discuss.elastic.co/t/winlogbeat-evt-4741-4742-4743-computer-management-events/206069/2 "2019-11-28T17:23:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.