what is Property ID?
am 15.04.2008 01:03:01 von Cam
I have enabled auditing of the IIS Metabase. Now when a change is made, an
event similar to the following appears in the Security event log:
Event Type: Success Audit
Event Source: IIS-METABASE
Event Category: Object Access
Event ID: 4505
Date: 2008/04/14
Time: 4:06:18 PM
User: DOMAIN\jeremiah
Computer: SALESWEBMACHINE
Description:
Metabase Set Data.
Primary User Name: jeremiah
Primary User Domain: DOMAIN
Primary Logon ID: (0x0,0x3D8A88A2)
Path: /LM
Property ID: 6269
Property Name: -
Old Value: -
New Value: 4660
Caller PID: 3444
Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
Result: 0x0
How do I interpret what was changed? I cannot find documentation on
"Property ID" and "Property Name" is blank.
Re: what is Property ID?
am 15.04.2008 08:24:41 von Kristofer Gafvert
Hello,
This is the property:
http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true
--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info
"Cam" skrev i meddelandet
news:C58CC1E4-595C-464B-9491-85F252791207@microsoft.com...
>I have enabled auditing of the IIS Metabase. Now when a change is made, an
> event similar to the following appears in the Security event log:
>
> Event Type: Success Audit
> Event Source: IIS-METABASE
> Event Category: Object Access
> Event ID: 4505
> Date: 2008/04/14
> Time: 4:06:18 PM
> User: DOMAIN\jeremiah
> Computer: SALESWEBMACHINE
> Description:
> Metabase Set Data.
>
> Primary User Name: jeremiah
> Primary User Domain: DOMAIN
> Primary Logon ID: (0x0,0x3D8A88A2)
> Path: /LM
> Property ID: 6269
> Property Name: -
> Old Value: -
> New Value: 4660
> Caller PID: 3444
> Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
> Result: 0x0
>
> How do I interpret what was changed? I cannot find documentation on
> "Property ID" and "Property Name" is blank.
Re: what is Property ID?
am 15.04.2008 08:24:41 von Kristofer Gafvert
Hello,
This is the property:
http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true
--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info
"Cam" skrev i meddelandet
news:C58CC1E4-595C-464B-9491-85F252791207@microsoft.com...
>I have enabled auditing of the IIS Metabase. Now when a change is made, an
> event similar to the following appears in the Security event log:
>
> Event Type: Success Audit
> Event Source: IIS-METABASE
> Event Category: Object Access
> Event ID: 4505
> Date: 2008/04/14
> Time: 4:06:18 PM
> User: DOMAIN\jeremiah
> Computer: SALESWEBMACHINE
> Description:
> Metabase Set Data.
>
> Primary User Name: jeremiah
> Primary User Domain: DOMAIN
> Primary Logon ID: (0x0,0x3D8A88A2)
> Path: /LM
> Property ID: 6269
> Property Name: -
> Old Value: -
> New Value: 4660
> Caller PID: 3444
> Caller Image Path: \Device\HarddiskVolume1\WINDOWS\system32\mmc.exe
> Result: 0x0
>
> How do I interpret what was changed? I cannot find documentation on
> "Property ID" and "Property Name" is blank.
Re: what is Property ID?
am 15.04.2008 19:17:05 von Cam
> This is the property:
> http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true
Property 6269 is only an example of a property I might care to look up. I am
looking for a list or some other documentation resource where I can easily
find information about a property given its ID.
Any suggestions?
Re: what is Property ID?
am 15.04.2008 19:17:05 von Cam
> This is the property:
> http://www.microsoft.com/technet/prodtechnol/WindowsServer20 03/Library/IIS/0c20f0c5-abf0-4d8c-b1e2-75414f746637.mspx?mfr =true
Property 6269 is only an example of a property I might care to look up. I am
looking for a list or some other documentation resource where I can easily
find information about a property given its ID.
Any suggestions?
Re: what is Property ID?
am 16.04.2008 03:35:48 von David Wang
On Apr 15, 10:17=A0am, Cam wrote:
> > This is the property:
> >http://www.microsoft.com/technet/prodtechnol/WindowsServer2 003/Librar...
>
> Property 6269 is only an example of a property I might care to look up. I =
am
> looking for a list or some other documentation resource where I can easily=
> find information about a property given its ID.
>
> Any suggestions?
If you get event log entries without friendly names, it is because
there wasn't any name mapping for it -- which usually means it is
internal and not meant for user consumption. My interpretation is that
one should not care about properties without a friendly name mapping,
and thus one should not care about a documentation resource to look up
property given an ID.
If you *really* want to do that mapping, feel free to do it yourself
-- search MSDN with a search engine. It should be easy enough.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
Re: what is Property ID?
am 16.04.2008 03:35:48 von David Wang
On Apr 15, 10:17=A0am, Cam wrote:
> > This is the property:
> >http://www.microsoft.com/technet/prodtechnol/WindowsServer2 003/Librar...
>
> Property 6269 is only an example of a property I might care to look up. I =
am
> looking for a list or some other documentation resource where I can easily=
> find information about a property given its ID.
>
> Any suggestions?
If you get event log entries without friendly names, it is because
there wasn't any name mapping for it -- which usually means it is
internal and not meant for user consumption. My interpretation is that
one should not care about properties without a friendly name mapping,
and thus one should not care about a documentation resource to look up
property given an ID.
If you *really* want to do that mapping, feel free to do it yourself
-- search MSDN with a search engine. It should be easy enough.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//