Bookmarks

Yahoo Gmail Google Facebook Delicious Twitter Reddit Stumpleupon Myspace Digg

Search queries

sqldatasource dal, wwwxxxenden, convert raid5 to raid 10 mdadm, apache force chunked, nrao wwwxxx, xxxxxdup, procmail change subject header, wwwXxx not20, Wwwxxx.doks sas, linux raid resync after reboot

Links

XODOX
Impressum

#1: what is Property ID?

Posted on 2008-04-15 01:03:01 by Cam

I have enabled auditing of the IIS Metabase. Now when a change is made, an
event similar to the following appears in the Security event log:

Event Type: Success Audit
Event Source: IIS-METABASE
Event Category: Object Access
Event ID: 4505
Date: 2008/04/14
Time: 4:06:18 PM
User: DOMAIN\jeremiah
Computer: SALESWEBMACHINE
Description:
Metabase Set Data.

Primary User Name: jeremiah
Primary User Domain: DOMAIN
Primary Logon ID: (0x0,0x3D8A88A2)
Path: /LM
Property ID: 6269
Property Name: -
Old Value: -
New Value: 4660
Caller PID: 3444
Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
Result: 0x0

How do I interpret what was changed? I cannot find documentation on
"Property ID" and "Property Name" is blank.

Report this message

#2: Re: what is Property ID?

Posted on 2008-04-15 08:24:41 by Kristofer Gafvert

Hello,


This is the property:
http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


"Cam" <Cam@discussions.microsoft.com> skrev i meddelandet
news:C58CC1E4-595C-464B-9491-85F252791207@microsoft.com...
>I have enabled auditing of the IIS Metabase. Now when a change is made, an
> event similar to the following appears in the Security event log:
>
> Event Type: Success Audit
> Event Source: IIS-METABASE
> Event Category: Object Access
> Event ID: 4505
> Date: 2008/04/14
> Time: 4:06:18 PM
> User: DOMAIN\jeremiah
> Computer: SALESWEBMACHINE
> Description:
> Metabase Set Data.
>
> Primary User Name: jeremiah
> Primary User Domain: DOMAIN
> Primary Logon ID: (0x0,0x3D8A88A2)
> Path: /LM
> Property ID: 6269
> Property Name: -
> Old Value: -
> New Value: 4660
> Caller PID: 3444
> Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
> Result: 0x0
>
> How do I interpret what was changed? I cannot find documentation on
> "Property ID" and "Property Name" is blank.

Report this message

#3: Re: what is Property ID?

Posted on 2008-04-15 08:24:41 by Kristofer Gafvert

Hello,


This is the property:
http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


"Cam" <Cam@discussions.microsoft.com> skrev i meddelandet
news:C58CC1E4-595C-464B-9491-85F252791207@microsoft.com...
>I have enabled auditing of the IIS Metabase. Now when a change is made, an
> event similar to the following appears in the Security event log:
>
> Event Type: Success Audit
> Event Source: IIS-METABASE
> Event Category: Object Access
> Event ID: 4505
> Date: 2008/04/14
> Time: 4:06:18 PM
> User: DOMAIN\jeremiah
> Computer: SALESWEBMACHINE
> Description:
> Metabase Set Data.
>
> Primary User Name: jeremiah
> Primary User Domain: DOMAIN
> Primary Logon ID: (0x0,0x3D8A88A2)
> Path: /LM
> Property ID: 6269
> Property Name: -
> Old Value: -
> New Value: 4660
> Caller PID: 3444
> Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
> Result: 0x0
>
> How do I interpret what was changed? I cannot find documentation on
> "Property ID" and "Property Name" is blank.

Report this message

#4: Re: what is Property ID?

Posted on 2008-04-15 19:17:05 by Cam

> This is the property:
> http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

Property 6269 is only an example of a property I might care to look up. I am
looking for a list or some other documentation resource where I can easily
find information about a property given its ID.

Any suggestions?

Report this message

#5: Re: what is Property ID?

Posted on 2008-04-15 19:17:05 by Cam

> This is the property:
> http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true

Property 6269 is only an example of a property I might care to look up. I am
looking for a list or some other documentation resource where I can easily
find information about a property given its ID.

Any suggestions?

Report this message

#6: Re: what is Property ID?

Posted on 2008-04-16 03:35:48 by David Wang

On Apr 15, 10:17=A0am, Cam <C...@discussions.microsoft.com> wrote:
> > This is the property:
> >http://www.microsoft.com/technet/prodtechnol/WindowsServer2 003/Librar...
>
> Property 6269 is only an example of a property I might care to look up. I =
am
> looking for a list or some other documentation resource where I can easily=

> find information about a property given its ID.
>
> Any suggestions?


If you get event log entries without friendly names, it is because
there wasn't any name mapping for it -- which usually means it is
internal and not meant for user consumption. My interpretation is that
one should not care about properties without a friendly name mapping,
and thus one should not care about a documentation resource to look up
property given an ID.

If you *really* want to do that mapping, feel free to do it yourself
-- search MSDN with a search engine. It should be easy enough.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Report this message

#7: Re: what is Property ID?

Posted on 2008-04-16 03:35:48 by David Wang

On Apr 15, 10:17=A0am, Cam <C...@discussions.microsoft.com> wrote:
> > This is the property:
> >http://www.microsoft.com/technet/prodtechnol/WindowsServer2 003/Librar...
>
> Property 6269 is only an example of a property I might care to look up. I =
am
> looking for a list or some other documentation resource where I can easily=

> find information about a property given its ID.
>
> Any suggestions?


If you get event log entries without friendly names, it is because
there wasn't any name mapping for it -- which usually means it is
internal and not meant for user consumption. My interpretation is that
one should not care about properties without a friendly name mapping,
and thus one should not care about a documentation resource to look up
property given an ID.

If you *really* want to do that mapping, feel free to do it yourself
-- search MSDN with a search engine. It should be easy enough.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Report this message