Bookmarks

Yahoo Gmail Google Facebook Delicious Twitter Reddit Stumpleupon Myspace Digg

Search queries

/proc/kallsyms format, sqldatasource dal, wwwxxxenden, convert raid5 to raid 10 mdadm, apache force chunked, nrao wwwxxx, xxxxxdup, procmail change subject header, wwwXxx not20, Wwwxxx.doks sas

Links

XODOX
Impressum

#1: what is Property ID?

Posted on 2008-04-15 01:03:01 by Cam

I have enabled auditing of the IIS Metabase. Now when a change is made, an
event similar to the following appears in the Security event log:

Event Type: Success Audit
Event Source: IIS-METABASE
Event Category: Object Access
Event ID: 4505
Date: 2008/04/14
Time: 4:06:18 PM
User: DOMAIN\jeremiah
Computer: SALESWEBMACHINE
Description:
Metabase Set Data.

Primary User Name: jeremiah
Primary User Domain: DOMAIN
Primary Logon ID: (0x0,0x3D8A88A2)
Path: /LM
Property ID: 6269
Property Name: -
Old Value: -
New Value: 4660
Caller PID: 3444
Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
Result: 0x0

How do I interpret what was changed? I cannot find documentation on
"Property ID" and "Property Name" is blank.

Report this message

#2: Re: what is Property ID?

Posted on 2008-04-15 08:24:41 by Kristofer Gafvert

Hello,


This is the property:
http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


"Cam" <Cam@discussions.microsoft.com> skrev i meddelandet
news:C58CC1E4-595C-464B-9491-85F252791207@microsoft.com...
>I have enabled auditing of the IIS Metabase. Now when a change is made, an
> event similar to the following appears in the Security event log:
>
> Event Type: Success Audit
> Event Source: IIS-METABASE
> Event Category: Object Access
> Event ID: 4505
> Date: 2008/04/14
> Time: 4:06:18 PM
> User: DOMAIN\jeremiah
> Computer: SALESWEBMACHINE
> Description:
> Metabase Set Data.
>
> Primary User Name: jeremiah
> Primary User Domain: DOMAIN
> Primary Logon ID: (0x0,0x3D8A88A2)
> Path: /LM
> Property ID: 6269
> Property Name: -
> Old Value: -
> New Value: 4660
> Caller PID: 3444
> Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
> Result: 0x0
>
> How do I interpret what was changed? I cannot find documentation on
> "Property ID" and "Property Name" is blank.

Report this message

#3: Re: what is Property ID?

Posted on 2008-04-15 08:24:41 by Kristofer Gafvert

Hello,


This is the property:
http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


"Cam" <Cam@discussions.microsoft.com> skrev i meddelandet
news:C58CC1E4-595C-464B-9491-85F252791207@microsoft.com...
>I have enabled auditing of the IIS Metabase. Now when a change is made, an
> event similar to the following appears in the Security event log:
>
> Event Type: Success Audit
> Event Source: IIS-METABASE
> Event Category: Object Access
> Event ID: 4505
> Date: 2008/04/14
> Time: 4:06:18 PM
> User: DOMAIN\jeremiah
> Computer: SALESWEBMACHINE
> Description:
> Metabase Set Data.
>
> Primary User Name: jeremiah
> Primary User Domain: DOMAIN
> Primary Logon ID: (0x0,0x3D8A88A2)
> Path: /LM
> Property ID: 6269
> Property Name: -
> Old Value: -
> New Value: 4660
> Caller PID: 3444
> Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
> Result: 0x0
>
> How do I interpret what was changed? I cannot find documentation on
> "Property ID" and "Property Name" is blank.

Report this message

#4: Re: what is Property ID?

Posted on 2008-04-15 19:17:05 by Cam

> This is the property:
> http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

Property 6269 is only an example of a property I might care to look up. I am
looking for a list or some other documentation resource where I can easily
find information about a property given its ID.

Any suggestions?

Report this message

#5: Re: what is Property ID?

Posted on 2008-04-15 19:17:05 by Cam

> This is the property:
> http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

Property 6269 is only an example of a property I might care to look up. I am
looking for a list or some other documentation resource where I can easily
find information about a property given its ID.

Any suggestions?

Report this message

#6: Re: what is Property ID?

Posted on 2008-04-16 03:35:48 by David Wang

On Apr 15, 10:17=A0am, Cam <C...@discussions.microsoft.com> wrote:
> > This is the property:
> >http://www.microsoft.com/technet/prodtechnol/WindowsServer2 003/Librar...
>
> Property 6269 is only an example of a property I might care to look up. I =
am
> looking for a list or some other documentation resource where I can easily=

> find information about a property given its ID.
>
> Any suggestions?


If you get event log entries without friendly names, it is because
there wasn't any name mapping for it -- which usually means it is
internal and not meant for user consumption. My interpretation is that
one should not care about properties without a friendly name mapping,
and thus one should not care about a documentation resource to look up
property given an ID.

If you *really* want to do that mapping, feel free to do it yourself
-- search MSDN with a search engine. It should be easy enough.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Report this message

#7: Re: what is Property ID?

Posted on 2008-04-16 03:35:48 by David Wang

On Apr 15, 10:17=A0am, Cam <C...@discussions.microsoft.com> wrote:
> > This is the property:
> >http://www.microsoft.com/technet/prodtechnol/WindowsServer2 003/Librar...
>
> Property 6269 is only an example of a property I might care to look up. I =
am
> looking for a list or some other documentation resource where I can easily=

> find information about a property given its ID.
>
> Any suggestions?


If you get event log entries without friendly names, it is because
there wasn't any name mapping for it -- which usually means it is
internal and not meant for user consumption. My interpretation is that
one should not care about properties without a friendly name mapping,
and thus one should not care about a documentation resource to look up
property given an ID.

If you *really* want to do that mapping, feel free to do it yourself
-- search MSDN with a search engine. It should be easy enough.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Report this message