Channel: Defines the audience for the event (for example, administrator or developer). Level: Specifies the severity or level of detail included in the event (for example, informational or fatal). Opcode: Identifies a step in a sequence of operations being performed within a Task. Task: Identifies a larger unit of work within an application or component (broader in scope than the Opcode). Keyword: A bitmask that specifies a logical group of related events. Each bit corresponds to one group. An event can belong to one or more groups. The keyword can contain one or more provider-defined keywords, standard keywords, or both. This structure represents an event defined in a manifest and is included in the structure. EVENT_HEADER The EVENT_HEADER structure defines the main parameters of an event. typedef struct _EVENT_HEADER { USHORT Size; USHORT HeaderType; USHORT Flags; USHORT EventProperty; ULONG ThreadId; ULONG ProcessId; LARGE_INTEGER TimeStamp; GUID ProviderId; EVENT_DESCRIPTOR EventDescriptor; union { struct { ULONG KernelTime; ULONG UserTime; }; ULONG64 ProcessorTime; }; GUID ActivityId; } EVENT_HEADER, *PEVENT_HEADER; Size: Size of the event record, in bytes. HeaderType: Reserved. Flags: Flags that provide information about the event such as the type of session it was logged to and whether the event contains extended data. This member can contain one or more of the following flags. Value Meaning EVENT_HEADER_FLAG_EXTENDED_INFO The ExtendedData member of the event record contains data. EVENT_HEADER_FLAG_PRIVATE_SESSION The event was logged to a private session. EVENT_HEADER_FLAG_STRING_ONLY The event data is a null-terminated Unicode string. EVENT_HEADER_FLAG_TRACE_MESSAGE The provider used an implementation-specific trace message function to log the event.Typically indicates that the event was written by the Windows software trace preprocessor. EVENT_HEADER_FLAG_NO_CPUTIME Indicates that elapsed execution time was not recorded; the
OWNER_RIGHTS S-1-3-4 A group that represents the current owner of the object. When an ACE that carries this SID is applied to an object, the system ignores the implicit READ_CONTROL and WRITE_DAC permissions for the object owner. NT_AUTHORITY S-1-5 A SID containing only the SECURITY_NT_AUTHORITY identifier authority. DIALUP S-1-5-1 A group that includes all users who have logged on through a dial-up connection. NETWORK S-1-5-2 A group that includes all users who have logged on through a network connection. BATCH S-1-5-3 A group that includes all users who have logged on through a batch queue facility. INTERACTIVE S-1-5-4 A group that includes all users who have logged on interactively. LOGON_ID S-1-5-5-x-y A logon session. The X and Y values for these SIDs are different for each logon session and are recycled when the operating system is restarted. SERVICE S-1-5-6 A group that includes all security principals that have logged on as a service. ANONYMOUS S-1-5-7 A group that represents an anonymous logon. PROXY S-1-5-8 Identifies a SECURITY_NT_AUTHORITY Proxy.<8> ENTERPRISE_DOMAIN_CONTROLLERS S-1-5-9 A group that includes all domain controllers in a forest that uses an Active Directory directory service. PRINCIPAL_SELF S-1-5-10 A placeholder in an inheritable ACE on an account object or group object in Active Directory. When the ACE is inherited, the system replaces this SID with the SID for the security principal that holds the account. AUTHENTICATED_USERS S-1-5-11 A group that includes all users whose identities were authenticated when they logged on. RESTRICTED_CODE S-1-5-12 This SID is used to control access by untrusted code. validation against tokens with RC consists of two checks, one against the token's normal list of SIDs and one against a second list (typically containing RC - the "RESTRICTED_CODE" token - and a subset of the original token SIDs). Access is granted only if a token passes both tests. Any ACL that specifies RC must also specify WD - the "EVERYONE" token. When RC is paired with WD in an ACL, a superset of
Set GrantedAccess to AllowedAccesses and (not DeniedAccesses) IF GrantedAccess not equals 0 THEN Return success ElSE Return access_denied END IF SET GrantedAccess to 0 IF RemainingAccess to 0 THEN Return success Else Return access_denied END IF END-SUBROUTINE STATUS_CODE AccessCheck( TOKEN Token, SECURITY_DESCRIPTOR SecurityDescriptor, ACCESS_MASK Access Request mask, OBJECT_TYPE_LIST Object Tree, Sid PrincipalSelfSubstitute, [out] ACCESS_MASK GrantedAccess) Dim CentralAccessPolicy CentralizedAccessPolicy Dim SECURITY_DESCRIPTOR CaprSecurityDescriptor Dim SECURITY_DESCRIPTOR StagedCaprSecurityDescriptor Dim ACCESS_MASK DesiredAccess Dim ACCESS_MASK CentralAccessPolicyEffectiveAccess Dim ACCESS_MASK CentralAccessPolicyEntryEffectiveAccess Dim ACCESS_MASK CentralAccessPolicyStagedAccess Dim ACCESS_MASK CentralAccessPolicyEntryStagedAccess Dim ULONG Result Dim STATUS_CODE Status Set DACL to SecurityDescriptor Dacl field Set SACL to SecurityDescriptor Sacl field Set RemainingAccess to Access Request mask Set AllowedAccesses to 0 Set DeniedAccesses to 0 Set DesiredAccess to Access Request mask CALL EvaluateTokenAgainstDescriptor(Token, SecurityDescriptor, DesiredAccess, Object Tree, PrincipalSelfSubstitute, GrantedAccess) returning Status IF Status is access_denied THEN return Status END IF CALL GetCentralizedAccessPolicy(SACL) returning CentralizedAccessPolicy IF CentralizedAccessPolicy is not NULL THEN Set CentralAccessPolicyEffectiveAccess to GrantedAccess Set CentralAccessPolicyStagedAccess to GrantedAccess FOR each CentralAccessPolicyRule in CentralAccessPolicy.RulesList EvaluateAceCondition(Token, SACL, AppliesTo, AppliesToSize) returning Result
Index A 55 60 61 56 42 58 60 62 58 42 53 55 81 83 42 42 42 42 13 42 42 B 42 42 42 42 42 C 13 42 42 149 90 88 42 42 14 28 16 42 42 38 42 42 42 D 14 14 28 16 38 91 42 42 42 42 42 42 42 42 E 42 42 42 28 29 42 42 136 F 13 31 G 8 42 42 42 31 H 42 I 42 137 42 12 42 8 42 L 32 42 42 42 42 42 13 42 31 34 35 33
M 88 42 42 42 42 42 42 42 33 N 42 42 42 11 42 42 42 42 O 33 42 12 42 42 P 55 83 28 90 88 42 42 28 29 31 31 32 33 88 33 42 42 42 143 42 42 41 34 86 34 35 41 68 38 87 38 38 R 42 42 42 42 42 References 12 11 13 13 42 42 42 42 42 41 39 34 S 42 42 137 137 91 83 86 34 35 42 42 42 41 38 136 64 66 SYSTEM_AUDIT_CALLBACK_OBJECT_ACE packet ( 65, 68) 67 68 70 71 38 T 42 42 42 42 87 149 U 38 38 42 31