Here is a description of what I've tried. (Note: Where the domain or a userid was listed I replaced with DOMAIN, user1id, and user2id.)
I saved an evt file to play with and used something similar to the following to generate the XML from the same EVT file:
"C:\Program Files\Log Parser 2.2\logparser.exe" file:ConvertToXML.sql -i:EVT -o:XML
ConvertToXML.SQL
----------------
SELECT timegenerated, timewritten, computername, eventid,eventtypename, eventcategory, eventcategoryname, sourcename, SID, Resolve_SID(SID) AS UserID, URLESCAPE(message,0) AS NewMessage, URLESCAPE(strings,0) AS NewStrings, data INTO c:\data\scripts\logparser\test0.xml
FROM badlogeventsec.evt
WHERE (eventid = 680)
I tried using URLESCAPE with no codepage parameter and with -1 and 0. When the resulting XML is opened in notepad, and the relevant fields copied in, this is what I see for one of the records.
Without specifying the codepage
<NewMessage>
Logon%20attempt%20by:%20MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%20Logon%20account:%20user1id%20Source%20Workstation:%20ath-cha-163d%20Error%20Code:%200x0%20
</NewMessage>
<NewStrings>
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%7cuser1id%7cath-cha-163d%7c0x0
</NewStrings>
Using 0
<NewMessage>
Logon%20attempt%20by:%20MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%20Logon%20account:%20user1id%20Source%20Workstation:%20ath-cha-163d%20Error%20Code:%200x0%20
</NewMessage>
<NewStrings>
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%7cuser1id%7cath-cha-163d%7c0x0
</NewStrings>
Using -1
<NewMessage>
Logon%20attempt%20by:%20MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%20Logon%20account:%20user1id%20Source%20Workstation:%20ath-cha-163d%20Error%20Code:%200x0%20
</NewMessage>
<NewStrings>
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%7cuser1id%7cath-cha-163d%7c0x0
</NewStrings>
I then ran something like the following:
"C:\Program Files\Log Parser 2.2\logparser.exe" file
etailingUserLoginsXML0.sql -i:XML -oatagrid
DetailingUserLoginsXML0.SQL
---------------------------
SELECT
TimeGenerated,EventID,UserID,URLUNESCAPE(NewMessage,0) AS Message,URLUNESCAPE(NewStrings,0) AS strings
FROM Test0.xml
WHERE EventID=680
When I run without specifying the codepage parameter or with -1, it stops after processing 965 elements. (This ends up being on the record listed above.)
When I ran using 0 for the codepage, it stopped after 5693 elements a different record. (XML snippet for this record below)
<NewMessage>
Logon%20attempt%20by:%20MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%20Logon%20account:%20user2id%20Source%20Workstation:%20UM1PRIM%20Error%20Code:%200x0%20
</NewMessage>
<NewStrings>
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0%7cuser2id%7cUM1PRIM%7c0x0
</NewStrings>
The result in either case is similar:
In the datagrid, I click All rows and scroll to the bottom. On the last record displayed in the grid, Message is displayed as I would expect and strings is NULL. Those last lines are pasted below.
codepage No value and -1
2006-04-26 15:00:09 680 DOMAIN\user1id Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: user1id Source Workstation: ath-cha-163d Error Code: 0x0 NULL
codepage 0
2006-04-26 15:18:31 680 DOMAIN\user2id Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon account: user2id Source Workstation: UM1PRIM Error Code: 0x0 NULL