3.2.4.1.5 Expanding Unexpanded Event Description Strings

The following insertion codes MAY appear as part of unexpanded description strings or during the process of expanding a description string.

Insertion code	Explanation
%n	EVENTLOGRECORD string: string indexed (n -1) in the EVENTLOGRECORD.Strings array, as specified in section 2.2.3
%%n	Parameter string: string with resource ID n in the parameter message file
%{S...}	Security identifier (SID)
%{...}	Globally unique identifier (GUID) (as specified in [MS-DTYP] section 2.3.4)

The client MUST replace insertion codes recursively <53> so that if the expanded string appears to contain another insertion code, it will also be expanded. The client MUST limit the number of substitutions to ensure that the algorithm will finish.<54>

This protocol does not contain an "escaping" mechanism to allow a literal string to go unexpanded when it contains a substring that looks like an insertion code. For example, suppose the unexpanded description string contains insertion code "%1", and the first EVENTLOGRECORD string (as specified in section 2.2.3) is a file name that in this case happens to contain "%1". The file name will be substituted into the description string, then the "%1" inside the file name will be interpreted as an insertion code and substituted with the whole file name, and so on, until the cap on the number of substitutions is reached (if such a cap is part of the client implementation).