This OCTET STRING is the thirteenth of up to fifteen event-specific variable slots on a Windows event trap, part of the extended set the MIB documents as used only by richer event variants like Windows Server 2003's 16-variable logon-failure event, beyond the 11 variables XP populates. Admins troubleshooting logon failures on mixed-OS environments should expect this field to be unused on older Windows versions. On a Server 2003 trap it might carry a process ID associated with the failed logon attempt.