mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 13:57:22 +00:00
Merge pull request #33 from JanKeller1/secaudit
Andrei's chgs: Schema info in tables
This commit is contained in:
Brian Lich
commit
6db675a76f
@ -165,23 +165,23 @@ This event shows that access was requested, and the results of the request, but
|
||||
|
||||
- **Accesses** \[Type = UnicodeString\]: the list of access rights which were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. The following table contains information about the most common access rights for file system objects. Access rights for registry objects are often similar to file system objects, but the table contains a few notes about how they vary.
|
||||
|
||||
| <span id="File_system_objects_access_rights" class="anchor"></span>Access | Hexadecimal Value | Description |
|
||||
|---------------------------------------------------------------------------------------------------|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| ReadData (or ListDirectory)<br><br>(For registry objects, this is “Query key value.”) | 0x1 | **ReadData -** For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.<br>**ListDirectory -** For a directory, the right to list the contents of the directory. |
|
||||
| WriteData (or AddFile)<br><br>(For registry objects, this is “Set key value.”) | 0x2 | **WriteData -** For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (**FILE\_ADD\_FILE**).<br>**AddFile -** For a directory, the right to create a file in the directory. |
|
||||
| AppendData (or AddSubdirectory or CreatePipeInstance) | 0x4 | **AppendData -** For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without **FILE\_WRITE\_DATA**.) For a directory object, the right to create a subdirectory (**FILE\_ADD\_SUBDIRECTORY**). <br>**AddSubdirectory -** For a directory, the right to create a subdirectory.<br>**CreatePipeInstance -** For a named pipe, the right to create a pipe. |
|
||||
| ReadEA<br>(For registry objects, this is “Enumerate sub-keys.”) | 0x8 | The right to read extended file attributes. |
|
||||
| WriteEA | 0x10 | The right to write extended file attributes. |
|
||||
| Execute/Traverse | 0x20 | **Execute** - For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.<br>**Traverse -** For a directory, the right to traverse the directory. By default, users are assigned the **BYPASS\_TRAVERSE\_CHECKING**  [privilege](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379306(v=vs.85).aspx), which ignores the **FILE\_TRAVERSE**  [access right](https://msdn.microsoft.com/en-us/library/windows/desktop/aa374902(v=vs.85).aspx). See the remarks in [File Security and Access Rights](https://msdn.microsoft.com/en-us/library/windows/desktop/aa364399(v=vs.85).aspx) for more information. |
|
||||
| DeleteChild | 0x40 | For a directory, the right to delete a directory and all the files it contains, including read-only files. |
|
||||
| ReadAttributes | 0x80 | The right to read file attributes. |
|
||||
| WriteAttributes | 0x100 | The right to write file attributes. |
|
||||
| DELETE | 0x10000 | The right to delete the object. |
|
||||
| READ\_CONTROL | 0x20000 | The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
|
||||
| WRITE\_DAC | 0x40000 | The right to modify the discretionary access control list (DACL) in the object's security descriptor. |
|
||||
| WRITE\_OWNER | 0x80000 | The right to change the owner in the object's security descriptor |
|
||||
| SYNCHRONIZE | 0x100000<br> | The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. |
|
||||
| ACCESS\_SYS\_SEC | 0x1000000 | The ACCESS\_SYS\_SEC access right controls the ability to get or set the SACL in an object's security descriptor. |
|
||||
| <span id="File_system_objects_access_rights" class="anchor"></span>Access | Hexadecimal Value,<br>Schema Value | Description |
|
||||
|---------------------------------------------------------------------------------------|-------------------------------------|----------------|
|
||||
| ReadData (or ListDirectory)<br><br>(For registry objects, this is “Query key value.”) | 0x1,<br>%%4416 | **ReadData -** For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.<br>**ListDirectory -** For a directory, the right to list the contents of the directory. |
|
||||
| WriteData (or AddFile)<br><br>(For registry objects, this is “Set key value.”) | 0x2,<br>%%4417 | **WriteData -** For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (**FILE\_ADD\_FILE**).<br>**AddFile -** For a directory, the right to create a file in the directory. |
|
||||
| AppendData (or AddSubdirectory or CreatePipeInstance) | 0x4,<br>%%4418 | **AppendData -** For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without **FILE\_WRITE\_DATA**.) For a directory object, the right to create a subdirectory (**FILE\_ADD\_SUBDIRECTORY**). <br>**AddSubdirectory -** For a directory, the right to create a subdirectory.<br>**CreatePipeInstance -** For a named pipe, the right to create a pipe. |
|
||||
| ReadEA<br>(For registry objects, this is “Enumerate sub-keys.”) | 0x8,<br>%%4419 | The right to read extended file attributes. |
|
||||
| WriteEA | 0x10,<br>%%4420 | The right to write extended file attributes. |
|
||||
| Execute/Traverse | 0x20,<br>%%4421 | **Execute** - For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.<br>**Traverse -** For a directory, the right to traverse the directory. By default, users are assigned the **BYPASS\_TRAVERSE\_CHECKING**  [privilege](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379306(v=vs.85).aspx), which ignores the **FILE\_TRAVERSE**  [access right](https://msdn.microsoft.com/en-us/library/windows/desktop/aa374902(v=vs.85).aspx). See the remarks in [File Security and Access Rights](https://msdn.microsoft.com/en-us/library/windows/desktop/aa364399(v=vs.85).aspx) for more information. |
|
||||
| DeleteChild | 0x40,<br>%%4422 | For a directory, the right to delete a directory and all the files it contains, including read-only files. |
|
||||
| ReadAttributes | 0x80,<br>%%4423 | The right to read file attributes. |
|
||||
| WriteAttributes | 0x100,<br>%%4424 | The right to write file attributes. |
|
||||
| DELETE | 0x10000,<br>%%1537 | The right to delete the object. |
|
||||
| READ\_CONTROL | 0x20000,<br>%%1538 | The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
|
||||
| WRITE\_DAC | 0x40000,<br>%%1539 | The right to modify the discretionary access control list (DACL) in the object's security descriptor. |
|
||||
| WRITE\_OWNER | 0x80000,<br>%%1540 | The right to change the owner in the object's security descriptor |
|
||||
| SYNCHRONIZE | 0x100000,<br>%%1541 | The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. |
|
||||
| ACCESS\_SYS\_SEC | 0x1000000,<br>%%1542 | The ACCESS\_SYS\_SEC access right controls the ability to get or set the SACL in an object's security descriptor. |
|
||||
|
||||
> <span id="_Ref433973578" class="anchor"></span>Table 14. File System objects access rights.
|
||||
|
||||
|
||||
@ -153,23 +153,23 @@ The main difference with “[4656](event-4656.md): A handle to an object was req
|
||||
|
||||
- **Accesses** \[Type = UnicodeString\]: the list of access rights which were used by **Subject\\Security ID**. These access rights depend on **Object Type**. The following table contains information about the most common access rights for file system objects. Access rights for registry objects are often similar to file system objects, but the table contains a few notes about how they vary.
|
||||
|
||||
| Access | Hexadecimal Value | Description |
|
||||
|----------------------------------------------------------------------------------------------------|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| ReadData (or ListDirectory) <br><br>(For registry objects, this is “Query key value.”) | 0x1 | **ReadData -** For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.<br>**ListDirectory -** For a directory, the right to list the contents of the directory. |
|
||||
| WriteData (or AddFile) <br><br>(For registry objects, this is “Set key value.”) | 0x2 | **WriteData -** For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (**FILE\_ADD\_FILE**).<br>**AddFile -** For a directory, the right to create a file in the directory. |
|
||||
| AppendData (or AddSubdirectory or CreatePipeInstance) | 0x4 | **AppendData -** For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without **FILE\_WRITE\_DATA**.) For a directory object, the right to create a subdirectory (**FILE\_ADD\_SUBDIRECTORY**). <br>**AddSubdirectory -** For a directory, the right to create a subdirectory.<br>**CreatePipeInstance -** For a named pipe, the right to create a pipe. |
|
||||
| ReadEA<br>(For registry objects, this is “Enumerate sub-keys.”) | 0x8 | The right to read extended file attributes. |
|
||||
| WriteEA | 0x10 | The right to write extended file attributes. |
|
||||
| Execute/Traverse | 0x20 | **Execute** - For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.<br>**Traverse -** For a directory, the right to traverse the directory. By default, users are assigned the **BYPASS\_TRAVERSE\_CHECKING**  [privilege](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379306(v=vs.85).aspx), which ignores the **FILE\_TRAVERSE**  [access right](https://msdn.microsoft.com/en-us/library/windows/desktop/aa374902(v=vs.85).aspx). See the remarks in [File Security and Access Rights](https://msdn.microsoft.com/en-us/library/windows/desktop/aa364399(v=vs.85).aspx) for more information. |
|
||||
| DeleteChild | 0x40 | For a directory, the right to delete a directory and all the files it contains, including read-only files. |
|
||||
| ReadAttributes | 0x80 | The right to read file attributes. |
|
||||
| WriteAttributes | 0x100 | The right to write file attributes. |
|
||||
| DELETE | 0x10000 | The right to delete the object. |
|
||||
| READ\_CONTROL | 0x20000 | The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
|
||||
| WRITE\_DAC | 0x40000 | The right to modify the discretionary access control list (DACL) in the object's security descriptor. |
|
||||
| WRITE\_OWNER | 0x80000 | The right to change the owner in the object's security descriptor |
|
||||
| SYNCHRONIZE | 0x100000<br> | The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. |
|
||||
| ACCESS\_SYS\_SEC | 0x1000000 | The ACCESS\_SYS\_SEC access right controls the ability to get or set the SACL in an object's security descriptor. |
|
||||
| Access | Hex Value,<br>Schema Value | Description |
|
||||
|----------------------------------------------------------------------------------------|-----------------------------|---------------------|
|
||||
| ReadData (or ListDirectory) <br><br>(For registry objects, this is “Query key value.”) | 0x1,<br>%%4416 | **ReadData -** For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.<br>**ListDirectory -** For a directory, the right to list the contents of the directory. |
|
||||
| WriteData (or AddFile) <br><br>(For registry objects, this is “Set key value.”) | 0x2,<br>%%4417 | **WriteData -** For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (**FILE\_ADD\_FILE**).<br>**AddFile -** For a directory, the right to create a file in the directory. |
|
||||
| AppendData (or AddSubdirectory or CreatePipeInstance) | 0x4,<br>%%4418 | **AppendData -** For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without **FILE\_WRITE\_DATA**.) For a directory object, the right to create a subdirectory (**FILE\_ADD\_SUBDIRECTORY**). <br>**AddSubdirectory -** For a directory, the right to create a subdirectory.<br>**CreatePipeInstance -** For a named pipe, the right to create a pipe. |
|
||||
| ReadEA<br>(For registry objects, this is “Enumerate sub-keys.”) | 0x8,<br>%%4419 | The right to read extended file attributes. |
|
||||
| WriteEA | 0x10,<br>%%4420 | The right to write extended file attributes. |
|
||||
| Execute/Traverse | 0x20,<br>%%4421 | **Execute** - For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.<br>**Traverse -** For a directory, the right to traverse the directory. By default, users are assigned the **BYPASS\_TRAVERSE\_CHECKING**  [privilege](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379306(v=vs.85).aspx), which ignores the **FILE\_TRAVERSE**  [access right](https://msdn.microsoft.com/en-us/library/windows/desktop/aa374902(v=vs.85).aspx). See the remarks in [File Security and Access Rights](https://msdn.microsoft.com/en-us/library/windows/desktop/aa364399(v=vs.85).aspx) for more information. |
|
||||
| DeleteChild | 0x40,<br>%%4422 | For a directory, the right to delete a directory and all the files it contains, including read-only files. |
|
||||
| ReadAttributes | 0x80,<br>%%4423 | The right to read file attributes. |
|
||||
| WriteAttributes | 0x100,<br>%%4424 | The right to write file attributes. |
|
||||
| DELETE | 0x10000,<br>%%1537 | The right to delete the object. |
|
||||
| READ\_CONTROL | 0x20000,<br>%%1538 | The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
|
||||
| WRITE\_DAC | 0x40000,<br>%%1539 | The right to modify the discretionary access control list (DACL) in the object's security descriptor. |
|
||||
| WRITE\_OWNER | 0x80000,<br>%%1540 | The right to change the owner in the object's security descriptor |
|
||||
| SYNCHRONIZE | 0x100000,<br>%%1541 | The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. |
|
||||
| ACCESS\_SYS\_SEC | 0x1000000,<br>%%1542 | The ACCESS\_SYS\_SEC access right controls the ability to get or set the SACL in an object's security descriptor. |
|
||||
|
||||
> Table 15. File System objects access rights.
|
||||
|
||||
|
||||
@ -131,7 +131,7 @@ This event generates when Dynamic Access Control Proposed [Central Access Policy
|
||||
**Current Central Access Policy results:**
|
||||
|
||||
- **Access Reasons** \[Type = UnicodeString\]: the list of access check results for Current Access Policy. The format of the result is:<br><br>
|
||||
REQUESTED\_ACCESS: RESULT ACE\_WHICH\_PROVEDED\_OR\_DENIED\_ACCESS.
|
||||
REQUESTED\_ACCESS: RESULT ACE\_WHICH\_PROVIDED\_OR\_DENIED\_ACCESS.
|
||||
|
||||
The possible REQUESTED\_ACCESS values are listed in the table below.
|
||||
|
||||
@ -167,7 +167,7 @@ The possible REQUESTED\_ACCESS values are listed in the table below.
|
||||
|
||||
- Unknown or unchecked
|
||||
|
||||
- ACE\_WHICH\_PROVEDED\_OR\_DENIED\_ACCESS:
|
||||
- ACE\_WHICH\_PROVIDED\_OR\_DENIED\_ACCESS:
|
||||
|
||||
- Ownership – if access was granted because of ownership of an object.
|
||||
|
||||
|
||||
@ -139,23 +139,23 @@ This event generates every time network share object (file or folder) was access
|
||||
|
||||
## Table of file access codes
|
||||
|
||||
| <span id="File_access_codes" class="anchor"></span>Access | Hexadecimal Value | Description |
|
||||
|-----------------------------------------------------------|-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| ReadData (or ListDirectory) | 0x1 | **ReadData -** For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.<br>**ListDirectory -** For a directory, the right to list the contents of the directory. |
|
||||
| WriteData (or AddFile) | 0x2 | **WriteData -** For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (**FILE\_ADD\_FILE**).<br>**AddFile -** For a directory, the right to create a file in the directory. |
|
||||
| AppendData (or AddSubdirectory or CreatePipeInstance) | 0x4 | **AppendData -** For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without **FILE\_WRITE\_DATA**.) For a directory object, the right to create a subdirectory (**FILE\_ADD\_SUBDIRECTORY**). <br>**AddSubdirectory -** For a directory, the right to create a subdirectory.<br>**CreatePipeInstance -** For a named pipe, the right to create a pipe. |
|
||||
| ReadEA | 0x8 | The right to read extended file attributes. |
|
||||
| WriteEA | 0x10 | The right to write extended file attributes. |
|
||||
| Execute/Traverse | 0x20 | **Execute** - For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.<br>**Traverse -** For a directory, the right to traverse the directory. By default, users are assigned the **BYPASS\_TRAVERSE\_CHECKING**  [privilege](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379306(v=vs.85).aspx), which ignores the **FILE\_TRAVERSE**  [access right](https://msdn.microsoft.com/en-us/library/windows/desktop/aa374902(v=vs.85).aspx). See the remarks in [File Security and Access Rights](https://msdn.microsoft.com/en-us/library/windows/desktop/aa364399(v=vs.85).aspx) for more information. |
|
||||
| DeleteChild | 0x40 | For a directory, the right to delete a directory and all the files it contains, including read-only files. |
|
||||
| ReadAttributes | 0x80 | The right to read file attributes. |
|
||||
| WriteAttributes | 0x100 | The right to write file attributes. |
|
||||
| DELETE | 0x10000 | The right to delete the object. |
|
||||
| READ\_CONTROL | 0x20000 | The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
|
||||
| WRITE\_DAC | 0x40000 | The right to modify the discretionary access control list (DACL) in the object's security descriptor. |
|
||||
| WRITE\_OWNER | 0x80000 | The right to change the owner in the object's security descriptor |
|
||||
| SYNCHRONIZE | 0x100000 | The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. |
|
||||
| ACCESS\_SYS\_SEC | 0x1000000 | The ACCESS\_SYS\_SEC access right controls the ability to get or set the SACL in an object's security descriptor. |
|
||||
| <span id="File_access_codes" class="anchor"></span>Access | Hex Value,<br>Schema Value | Description |
|
||||
|-----------------------------------------------------------|----------------------------|---------------|
|
||||
| ReadData (or ListDirectory) | 0x1,<br>%%4416 | **ReadData -** For a file object, the right to read the corresponding file data. For a directory object, the right to read the corresponding directory data.<br>**ListDirectory -** For a directory, the right to list the contents of the directory. |
|
||||
| WriteData (or AddFile) | 0x2,<br>%%4417 | **WriteData -** For a file object, the right to write data to the file. For a directory object, the right to create a file in the directory (**FILE\_ADD\_FILE**).<br>**AddFile -** For a directory, the right to create a file in the directory. |
|
||||
| AppendData (or AddSubdirectory or CreatePipeInstance) | 0x4,<br>%%4418 | **AppendData -** For a file object, the right to append data to the file. (For local files, write operations will not overwrite existing data if this flag is specified without **FILE\_WRITE\_DATA**.) For a directory object, the right to create a subdirectory (**FILE\_ADD\_SUBDIRECTORY**). <br>**AddSubdirectory -** For a directory, the right to create a subdirectory.<br>**CreatePipeInstance -** For a named pipe, the right to create a pipe. |
|
||||
| ReadEA | 0x8,<br>%%4419 | The right to read extended file attributes. |
|
||||
| WriteEA | 0x10,<br>%%4420 | The right to write extended file attributes. |
|
||||
| Execute/Traverse | 0x20,<br>%%4421 | **Execute** - For a native code file, the right to execute the file. This access right given to scripts may cause the script to be executable, depending on the script interpreter.<br>**Traverse -** For a directory, the right to traverse the directory. By default, users are assigned the **BYPASS\_TRAVERSE\_CHECKING**  [privilege](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379306(v=vs.85).aspx), which ignores the **FILE\_TRAVERSE**  [access right](https://msdn.microsoft.com/en-us/library/windows/desktop/aa374902(v=vs.85).aspx). See the remarks in [File Security and Access Rights](https://msdn.microsoft.com/en-us/library/windows/desktop/aa364399(v=vs.85).aspx) for more information. |
|
||||
| DeleteChild | 0x40,<br>%%4422 | For a directory, the right to delete a directory and all the files it contains, including read-only files. |
|
||||
| ReadAttributes | 0x80,<br>%%4423 | The right to read file attributes. |
|
||||
| WriteAttributes | 0x100,<br>%%4424 | The right to write file attributes. |
|
||||
| DELETE | 0x10000,<br>%%1537 | The right to delete the object. |
|
||||
| READ\_CONTROL | 0x20000,<br>%%1538 | The right to read the information in the object's security descriptor, not including the information in the system access control list (SACL). |
|
||||
| WRITE\_DAC | 0x40000,<br>%%1539 | The right to modify the discretionary access control list (DACL) in the object's security descriptor. |
|
||||
| WRITE\_OWNER | 0x80000,<br>%%1540 | The right to change the owner in the object's security descriptor |
|
||||
| SYNCHRONIZE | 0x100000,<br>%%1541 | The right to use the object for synchronization. This enables a thread to wait until the object is in the signaled state. Some object types do not support this access right. |
|
||||
| ACCESS\_SYS\_SEC | 0x1000000,<br>%%1542 | The ACCESS\_SYS\_SEC access right controls the ability to get or set the SACL in an object's security descriptor. |
|
||||
|
||||
> <span id="_Ref433878809" class="anchor"></span>Table 13. File access codes.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user