diff --git a/browsers/edge/images/config-open-me-with-scenarios-tab.PNG b/browsers/edge/images/config-open-me-with-scenarios-tab.png similarity index 100% rename from browsers/edge/images/config-open-me-with-scenarios-tab.PNG rename to browsers/edge/images/config-open-me-with-scenarios-tab.png diff --git a/education/windows/images/setedupolicies_omauri.PNG b/education/windows/images/setedupolicies_omauri.png similarity index 100% rename from education/windows/images/setedupolicies_omauri.PNG rename to education/windows/images/setedupolicies_omauri.png diff --git a/education/windows/images/suspcs/suspc_getstarted_050817.PNG b/education/windows/images/suspcs/suspc_getstarted_050817.png similarity index 100% rename from education/windows/images/suspcs/suspc_getstarted_050817.PNG rename to education/windows/images/suspcs/suspc_getstarted_050817.png diff --git a/education/windows/images/suspcs/suspc_runpackage_getpcsready.PNG b/education/windows/images/suspcs/suspc_runpackage_getpcsready.png similarity index 100% rename from education/windows/images/suspcs/suspc_runpackage_getpcsready.PNG rename to education/windows/images/suspcs/suspc_runpackage_getpcsready.png diff --git a/education/windows/images/wcd/setedupolicies.PNG b/education/windows/images/wcd/setedupolicies.png similarity index 100% rename from education/windows/images/wcd/setedupolicies.PNG rename to education/windows/images/wcd/setedupolicies.png diff --git a/education/windows/images/wcd/wcd_settings_assignedaccess.PNG b/education/windows/images/wcd/wcd_settings_assignedaccess.png similarity index 100% rename from education/windows/images/wcd/wcd_settings_assignedaccess.PNG rename to education/windows/images/wcd/wcd_settings_assignedaccess.png diff --git a/store-for-business/images/msfb-add-collection.PNG b/store-for-business/images/msfb-add-collection.png similarity index 100% rename from store-for-business/images/msfb-add-collection.PNG rename to store-for-business/images/msfb-add-collection.png diff --git a/store-for-business/images/wsfb-private-store-gpo.PNG b/store-for-business/images/wsfb-private-store-gpo.png similarity index 100% rename from store-for-business/images/wsfb-private-store-gpo.PNG rename to store-for-business/images/wsfb-private-store-gpo.png diff --git a/windows/configuration/images/account-management-details.png b/windows/configuration/images/account-management-details.png new file mode 100644 index 0000000000..e4307d8f7b Binary files /dev/null and b/windows/configuration/images/account-management-details.png differ diff --git a/windows/configuration/images/add-applications-details.png b/windows/configuration/images/add-applications-details.png new file mode 100644 index 0000000000..2efd3483ae Binary files /dev/null and b/windows/configuration/images/add-applications-details.png differ diff --git a/windows/configuration/images/add-certificates-details.png b/windows/configuration/images/add-certificates-details.png new file mode 100644 index 0000000000..78cd783282 Binary files /dev/null and b/windows/configuration/images/add-certificates-details.png differ diff --git a/windows/configuration/images/admx-category.png b/windows/configuration/images/admx-category.png new file mode 100644 index 0000000000..465dd53fe3 Binary files /dev/null and b/windows/configuration/images/admx-category.png differ diff --git a/windows/configuration/images/admx-policy.png b/windows/configuration/images/admx-policy.png new file mode 100644 index 0000000000..c3c7b9a088 Binary files /dev/null and b/windows/configuration/images/admx-policy.png differ diff --git a/windows/configuration/images/apn-add-details.png b/windows/configuration/images/apn-add-details.png new file mode 100644 index 0000000000..caee3d6429 Binary files /dev/null and b/windows/configuration/images/apn-add-details.png differ diff --git a/windows/configuration/images/apn-add.png b/windows/configuration/images/apn-add.png new file mode 100644 index 0000000000..0e25e5c0e9 Binary files /dev/null and b/windows/configuration/images/apn-add.png differ diff --git a/windows/configuration/images/customization-start-edge.png b/windows/configuration/images/customization-start-edge.png new file mode 100644 index 0000000000..333833d8c0 Binary files /dev/null and b/windows/configuration/images/customization-start-edge.png differ diff --git a/windows/configuration/images/customization-start.png b/windows/configuration/images/customization-start.png new file mode 100644 index 0000000000..4942338181 Binary files /dev/null and b/windows/configuration/images/customization-start.png differ diff --git a/windows/configuration/images/icd-create-options-1703.png b/windows/configuration/images/icd-create-options-1703.png new file mode 100644 index 0000000000..007e740683 Binary files /dev/null and b/windows/configuration/images/icd-create-options-1703.png differ diff --git a/windows/configuration/images/icd-desktop-1703.png b/windows/configuration/images/icd-desktop-1703.png new file mode 100644 index 0000000000..7c060af4d0 Binary files /dev/null and b/windows/configuration/images/icd-desktop-1703.png differ diff --git a/windows/configuration/images/icd-runtime.png b/windows/configuration/images/icd-runtime.png new file mode 100644 index 0000000000..d63544e206 Binary files /dev/null and b/windows/configuration/images/icd-runtime.png differ diff --git a/windows/configuration/images/icd-setting-help.png b/windows/configuration/images/icd-setting-help.png new file mode 100644 index 0000000000..3f6e5fefa5 Binary files /dev/null and b/windows/configuration/images/icd-setting-help.png differ diff --git a/windows/configuration/images/icd-step1.png b/windows/configuration/images/icd-step1.png new file mode 100644 index 0000000000..d2ad656d35 Binary files /dev/null and b/windows/configuration/images/icd-step1.png differ diff --git a/windows/configuration/images/icd-step2.png b/windows/configuration/images/icd-step2.png new file mode 100644 index 0000000000..54e70d9193 Binary files /dev/null and b/windows/configuration/images/icd-step2.png differ diff --git a/windows/configuration/images/icd-step3.png b/windows/configuration/images/icd-step3.png new file mode 100644 index 0000000000..ecac26f3d6 Binary files /dev/null and b/windows/configuration/images/icd-step3.png differ diff --git a/windows/configuration/images/icd-step4.png b/windows/configuration/images/icd-step4.png new file mode 100644 index 0000000000..8fcfa2863b Binary files /dev/null and b/windows/configuration/images/icd-step4.png differ diff --git a/windows/configuration/images/icd-step5.png b/windows/configuration/images/icd-step5.png new file mode 100644 index 0000000000..9e96edd812 Binary files /dev/null and b/windows/configuration/images/icd-step5.png differ diff --git a/windows/configuration/images/icd-switch.png b/windows/configuration/images/icd-switch.png new file mode 100644 index 0000000000..e46e48a648 Binary files /dev/null and b/windows/configuration/images/icd-switch.png differ diff --git a/windows/configuration/images/kiosk-account-details.png b/windows/configuration/images/kiosk-account-details.png new file mode 100644 index 0000000000..53c31880ea Binary files /dev/null and b/windows/configuration/images/kiosk-account-details.png differ diff --git a/windows/configuration/images/kiosk-common-details.png b/windows/configuration/images/kiosk-common-details.png new file mode 100644 index 0000000000..5eda9b293e Binary files /dev/null and b/windows/configuration/images/kiosk-common-details.png differ diff --git a/windows/configuration/images/kiosk-desktop.png b/windows/configuration/images/kiosk-desktop.png new file mode 100644 index 0000000000..cf74c646c7 Binary files /dev/null and b/windows/configuration/images/kiosk-desktop.png differ diff --git a/windows/configuration/images/kiosk-fullscreen.png b/windows/configuration/images/kiosk-fullscreen.png new file mode 100644 index 0000000000..37ccd4f8a4 Binary files /dev/null and b/windows/configuration/images/kiosk-fullscreen.png differ diff --git a/windows/configuration/images/kiosk-settings.png b/windows/configuration/images/kiosk-settings.png new file mode 100644 index 0000000000..51a4338371 Binary files /dev/null and b/windows/configuration/images/kiosk-settings.png differ diff --git a/windows/configuration/images/set-up-device-details-desktop.png b/windows/configuration/images/set-up-device-details-desktop.png new file mode 100644 index 0000000000..97c8a1b704 Binary files /dev/null and b/windows/configuration/images/set-up-device-details-desktop.png differ diff --git a/windows/configuration/images/set-up-device-details.png b/windows/configuration/images/set-up-device-details.png new file mode 100644 index 0000000000..031dac6fe6 Binary files /dev/null and b/windows/configuration/images/set-up-device-details.png differ diff --git a/windows/configuration/images/set-up-network-details-desktop.png b/windows/configuration/images/set-up-network-details-desktop.png new file mode 100644 index 0000000000..83911ccbd0 Binary files /dev/null and b/windows/configuration/images/set-up-network-details-desktop.png differ diff --git a/windows/configuration/images/set-up-network-details.png b/windows/configuration/images/set-up-network-details.png new file mode 100644 index 0000000000..778b8497c4 Binary files /dev/null and b/windows/configuration/images/set-up-network-details.png differ diff --git a/windows/configuration/images/user.png b/windows/configuration/images/user.png new file mode 100644 index 0000000000..d1386d4a0d Binary files /dev/null and b/windows/configuration/images/user.png differ diff --git a/windows/configuration/images/wcd-app-commands.png b/windows/configuration/images/wcd-app-commands.png new file mode 100644 index 0000000000..e52908960f Binary files /dev/null and b/windows/configuration/images/wcd-app-commands.png differ diff --git a/windows/configuration/images/wcd-app-name.png b/windows/configuration/images/wcd-app-name.png new file mode 100644 index 0000000000..23ff06eada Binary files /dev/null and b/windows/configuration/images/wcd-app-name.png differ diff --git a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md index 9dc8d45822..2c13953d7d 100644 --- a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md +++ b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md @@ -98,17 +98,6 @@ To validate a UE-V settings location template with the UE-V template generator: After you validate the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into a production environment in enterprise. -## Next steps - -## Share settings location templates with the Template Gallery - -Before you share a settings location template on the UE-V template gallery, ensure it doesn't contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share a template with anyone outside your company. - -- Template Author Name - Specify a general, non-identifying name for the template author name or exclude this data from the template. -- Template Author Email - Specify a general, non-identifying template author email or exclude this data from the template. - -Before you deploy any settings location template that you've downloaded from the UE-V gallery, you should first test the template to ensure that the application settings synchronize settings correctly in a test environment. - ## Related topics [Administering UE-V](uev-administering-uev.md) diff --git a/windows/deployment/images/ISE.PNG b/windows/deployment/images/ISE.png similarity index 100% rename from windows/deployment/images/ISE.PNG rename to windows/deployment/images/ISE.png diff --git a/windows/deployment/images/configmgr-client.PNG b/windows/deployment/images/configmgr-client.png similarity index 100% rename from windows/deployment/images/configmgr-client.PNG rename to windows/deployment/images/configmgr-client.png diff --git a/windows/deployment/images/configmgr-collection.PNG b/windows/deployment/images/configmgr-collection.png similarity index 100% rename from windows/deployment/images/configmgr-collection.PNG rename to windows/deployment/images/configmgr-collection.png diff --git a/windows/deployment/images/configmgr-install-os.PNG b/windows/deployment/images/configmgr-install-os.png similarity index 100% rename from windows/deployment/images/configmgr-install-os.PNG rename to windows/deployment/images/configmgr-install-os.png diff --git a/windows/deployment/images/configmgr-post-refresh.PNG b/windows/deployment/images/configmgr-post-refresh.png similarity index 100% rename from windows/deployment/images/configmgr-post-refresh.PNG rename to windows/deployment/images/configmgr-post-refresh.png diff --git a/windows/deployment/images/configmgr-pxe.PNG b/windows/deployment/images/configmgr-pxe.png similarity index 100% rename from windows/deployment/images/configmgr-pxe.PNG rename to windows/deployment/images/configmgr-pxe.png diff --git a/windows/deployment/images/configmgr-site.PNG b/windows/deployment/images/configmgr-site.png similarity index 100% rename from windows/deployment/images/configmgr-site.PNG rename to windows/deployment/images/configmgr-site.png diff --git a/windows/deployment/images/configmgr-software-cntr.PNG b/windows/deployment/images/configmgr-software-cntr.png similarity index 100% rename from windows/deployment/images/configmgr-software-cntr.PNG rename to windows/deployment/images/configmgr-software-cntr.png diff --git a/windows/deployment/images/deploy-finish.PNG b/windows/deployment/images/deploy-finish.png similarity index 100% rename from windows/deployment/images/deploy-finish.PNG rename to windows/deployment/images/deploy-finish.png diff --git a/windows/deployment/images/disk2vhd-gen2.PNG b/windows/deployment/images/disk2vhd-gen2.png similarity index 100% rename from windows/deployment/images/disk2vhd-gen2.PNG rename to windows/deployment/images/disk2vhd-gen2.png diff --git a/windows/deployment/images/disk2vhd.PNG b/windows/deployment/images/disk2vhd.png similarity index 100% rename from windows/deployment/images/disk2vhd.PNG rename to windows/deployment/images/disk2vhd.png diff --git a/windows/deployment/images/disk2vhd4.PNG b/windows/deployment/images/disk2vhd4.png similarity index 100% rename from windows/deployment/images/disk2vhd4.PNG rename to windows/deployment/images/disk2vhd4.png diff --git a/windows/deployment/images/event.PNG b/windows/deployment/images/event.png similarity index 100% rename from windows/deployment/images/event.PNG rename to windows/deployment/images/event.png diff --git a/windows/deployment/images/feedback.PNG b/windows/deployment/images/feedback.png similarity index 100% rename from windows/deployment/images/feedback.PNG rename to windows/deployment/images/feedback.png diff --git a/windows/deployment/images/image.PNG b/windows/deployment/images/image.png similarity index 100% rename from windows/deployment/images/image.PNG rename to windows/deployment/images/image.png diff --git a/windows/deployment/images/monitor-pc0001.PNG b/windows/deployment/images/monitor-pc0001.png similarity index 100% rename from windows/deployment/images/monitor-pc0001.PNG rename to windows/deployment/images/monitor-pc0001.png diff --git a/windows/deployment/images/smodeconfig.PNG b/windows/deployment/images/smodeconfig.png similarity index 100% rename from windows/deployment/images/smodeconfig.PNG rename to windows/deployment/images/smodeconfig.png diff --git a/windows/deployment/update/images/waas-active-hours-policy.PNG b/windows/deployment/update/images/waas-active-hours-policy.png similarity index 100% rename from windows/deployment/update/images/waas-active-hours-policy.PNG rename to windows/deployment/update/images/waas-active-hours-policy.png diff --git a/windows/deployment/update/images/waas-active-hours.PNG b/windows/deployment/update/images/waas-active-hours.png similarity index 100% rename from windows/deployment/update/images/waas-active-hours.PNG rename to windows/deployment/update/images/waas-active-hours.png diff --git a/windows/security/operating-system-security/network-security/vpn/images/vpn-app-trigger.PNG b/windows/security/operating-system-security/network-security/vpn/images/vpn-app-trigger.png similarity index 100% rename from windows/security/operating-system-security/network-security/vpn/images/vpn-app-trigger.PNG rename to windows/security/operating-system-security/network-security/vpn/images/vpn-app-trigger.png diff --git a/windows/security/threat-protection/auditing/event-4913.md b/windows/security/threat-protection/auditing/event-4913.md index 279791472e..41c8fe6d12 100644 --- a/windows/security/threat-protection/auditing/event-4913.md +++ b/windows/security/threat-protection/auditing/event-4913.md @@ -1,5 +1,5 @@ --- -title: 4913(S) Central Access Policy on the object was changed. +title: 4913(S) Central Access Policy on the object was changed description: Describes security event 4913(S) Central Access Policy on the object was changed. ms.pagetype: security ms.mktglfcycl: deploy @@ -7,14 +7,13 @@ ms.sitesec: library ms.localizationpriority: low author: vinaypamnani-msft ms.date: 09/08/2021 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: reference --- -# 4913(S): Central Access Policy on the object was changed. - +# 4913(S): Central Access Policy on the object was changed Event 4913 illustration @@ -24,44 +23,45 @@ ms.topic: reference This event generates when a [Central Access Policy](/windows-server/identity/solution-guides/scenario--central-access-policy) on a file system object is changed. -This event always generates, regardless of the object’s [SACL](/windows/win32/secauthz/access-control-lists) settings. +This event always generates, regardless of the object's [SACL](/windows/win32/secauthz/access-control-lists) settings. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. -
***Event XML:*** -``` + +```xml - - - - 4913 - 0 - 0 - 13570 - 0 - 0x8020000000000000 - - 1183666 - - - Security - DC01.contoso.local - + + 4913 + 0 + 0 + 13570 + 0 + 0x8020000000000000 + + 1183666 + + + Security + DC01.contoso.local + - - S-1-5-21-3457937927-2839227994-823803824-1104 - dadmin - CONTOSO - 0x37901 - Security - File - C:\\Audit Files\\HBI Data.txt - 0x3d4 - S:AI - S:ARAI(SP;ID;;;;S-1-17-1442530252-1178042555-1247349694-2318402534) - 0x884 - C:\\Windows\\System32\\dllhost.exe + S-1-5-21-3457937927-2839227994-823803824-1104 + dadmin + CONTOSO + 0x37901 + Security + File + C:\\Audit Files\\HBI Data.txt + 0x3d4 + S:AI + S:ARAI(SP;ID;;;;S-1-17-1442530252-1178042555-1247349694-2318402534) + 0x884 + C:\\Windows\\System32\\dllhost.exe ``` @@ -82,7 +82,7 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/ - **Account Name** \[Type = UnicodeString\]**:** the name of the account that changed the Central Access Policy on the object. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following ones: +- **Account Domain** \[Type = UnicodeString\]**:** subject's domain or computer name. Formats vary, and include the following ones: - Domain NETBIOS name example: CONTOSO @@ -90,17 +90,17 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/ - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](/windows/security/identity-protection/access-control/security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](/windows-server/identity/ad-ds/manage/understand-security-identifiers), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.” +- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on." **Object**: -- **Object Server** \[Type = UnicodeString\]: has “**Security**” value for this event. +- **Object Server** \[Type = UnicodeString\]: has "**Security**" value for this event. -- **Object Type** \[Type = UnicodeString\]: The type of an object that was accessed during the operation. Always **“File”** for this event. +- **Object Type** \[Type = UnicodeString\]: The type of an object that was accessed during the operation. Always **"File"** for this event. The following table contains the list of the most common **Object Types**: @@ -118,7 +118,7 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/ -- **Handle ID** \[Type = Pointer\]: hexadecimal value of a handle to **Object Name**. This field can help you correlate this event with other events that might contain the same Handle ID, for example, “[4663](event-4663.md)(S): An attempt was made to access an object.” This parameter might not be captured in the event, and in that case appears as “0x0”. +- **Handle ID** \[Type = Pointer\]: hexadecimal value of a handle to **Object Name**. This field can help you correlate this event with other events that might contain the same Handle ID, for example, "[4663](event-4663.md)(S): An attempt was made to access an object." This parameter might not be captured in the event, and in that case appears as "0x0". **Process:** @@ -128,7 +128,7 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/ If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager. - You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID** field. + You can also correlate this process ID with a process ID in other events, for example, "[4688](event-4688.md): A new process has been created" **Process Information\\New Process ID** field. - **Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process. @@ -136,29 +136,30 @@ This event always generates, regardless of the object’s [SACL](/windows/win32/ - **Original Security Descriptor** \[Type = UnicodeString\]**:** the Security Descriptor Definition Language (SDDL) value for the old Central Policy ID (for the policy that was formerly applied to the object). - SDDL contains Central Access Policy SID, here's an example: S:ARAI(SP;ID;;;;S-1-17-1442530252-1178042555-1247349694-2318402534), Central Access Policy SID here is “**S-1-17-1442530252-1178042555-1247349694-2318402534**”. To resolve this SID to the real Central Access Policy name, you need to do the following steps: + SDDL contains Central Access Policy SID, here's an example: S:ARAI(SP;ID;;;;S-1-17-1442530252-1178042555-1247349694-2318402534), Central Access Policy SID here is "**S-1-17-1442530252-1178042555-1247349694-2318402534**". To resolve this SID to the real Central Access Policy name, you need to do the following steps: -1. Find Central Access Policy Active Directory object in: “CN=Central Access Policies,CN=Claims Configuration,CN=Services,CN=Configuration,DC=XXX,DC=XX” Active Directory container. +1. Find Central Access Policy Active Directory object in: "CN=Central Access Policies,CN=Claims Configuration,CN=Services,CN=Configuration,DC=XXX,DC=XX" Active Directory container. -2. Open object’s “**Properties**”. +2. Open object's "**Properties**". -3. Find “**msAuthz-CentralAccessPolicyID**” attribute. +3. Find "**msAuthz-CentralAccessPolicyID**" attribute. -4. Convert hexadecimal value to SID (string). Here you can see more information about how to perform this action: . +4. Convert hexadecimal value to SID (string). ADSI Edit illustration -> If no Central Access Policies were applied to the object, then SDDL will not contain any SIDs, for example “**S:AI**”. +> If no Central Access Policies were applied to the object, then SDDL will not contain any SIDs, for example "**S:AI**". - **New Security Descriptor** \[Type = UnicodeString\]**:** the Security Descriptor Definition Language (SDDL) value for the new Central Policy ID (for the policy that has been applied to the object). See more information in **Central Policy ID\\Original Security Descriptor** field section for this event. -> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. -> +> [!NOTE] +> The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> > Example: -> -> *O*:BA*G*:SY*D*:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0×7;;;BA)*S*:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) -> -> - *O*: = Owner. SID of specific security principal, or reserved (pre-defined) value, for example: BA (BUILTIN\_ADMINISTRATORS), WD (Everyone), SY (LOCAL\_SYSTEM), etc. +> +> `*O*:BA*G*:SY*D*:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0×7;;;BA)*S*:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD)` +> +> - *O*: = Owner. SID of specific security principal, or reserved (pre-defined) value, for example: BA (BUILTIN\_ADMINISTRATORS), WD (Everyone), SY (LOCAL\_SYSTEM), etc. > See the list of possible values in the table below: | Value | Description | Value | Description | @@ -193,13 +194,13 @@ Example: D:(A;;FA;;;WD) - entry\_type: -“D” - DACL +"D" - DACL -“S” - SACL +"S" - SACL - inheritance\_flags: -"P” - SDDL\_PROTECTED, Inheritance from containers that are higher in the folder hierarchy are blocked. +"P" - SDDL\_PROTECTED, Inheritance from containers that are higher in the folder hierarchy are blocked. "AI" - SDDL\_AUTO\_INHERITED, Inheritance is allowed, assuming that "P" isn't also set. @@ -231,7 +232,7 @@ Example: D:(A;;FA;;;WD) "NP" - NO PROPAGATE: only immediate children inherit this ace. -"IO" - INHERITANCE ONLY: ace doesn’t apply to this object, but may affect children via inheritance. +"IO" - INHERITANCE ONLY: ace doesn't apply to this object, but may affect children via inheritance. "ID" - ACE IS INHERITED @@ -262,24 +263,26 @@ Example: D:(A;;FA;;;WD) - inherit\_object\_guid: N/A - account\_sid: SID of specific security principal, or reserved value, for example: AN (Anonymous), WD (Everyone), SY (LOCAL\_SYSTEM), etc. For more information, see the table above. -For more information about SDDL syntax, see these articles: , . +For more information about SDDL syntax, see these articles: + +- [2.5.1.1 Syntax](/openspecs/windows_protocols/ms-dtyp/f4296d69-1c0f-491f-9587-a960b292d070) +- [ACCESS_MASK](/windows/win32/secauthz/access-mask) ## Security Monitoring Recommendations For 4913(S): Central Access Policy on the object was changed. -> **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). +> [!IMPORTANT] +> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). -- If you need to monitor events related to specific Windows object types (“**Object Type**”), for example **File** or **Key**, monitor this event for the corresponding “**Object Type**.” +- If you need to monitor events related to specific Windows object types ("**Object Type**"), for example **File** or **Key**, monitor this event for the corresponding "**Object Type**." -- If you need to monitor all changes to specific files or folders (in this case, changes to the Central Access Policy), monitor for the “**Object Name**” that corresponds to the file or folder. +- If you need to monitor all changes to specific files or folders (in this case, changes to the Central Access Policy), monitor for the "**Object Name**" that corresponds to the file or folder. -- If you have a pre-defined “**Process Name**” for the process reported in this event, monitor all events with “**Process Name**” not equal to your defined value. +- If you have a pre-defined "**Process Name**" for the process reported in this event, monitor all events with "**Process Name**" not equal to your defined value. -- You can monitor to see if “**Process Name**” isn't in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). +- You can monitor to see if "**Process Name**" isn't in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). - +- If you have a pre-defined list of restricted substrings or words in process names (for example, "**mimikatz**" or "**cain.exe**"), check for these substrings in "**Process Name**." -- If you have a pre-defined list of restricted substrings or words in process names (for example, “**mimikatz**” or “**cain.exe**”), check for these substrings in “**Process Name**.” - -- If you have specific files, folders, or entire systems to which a specific Central Access Policy should be applied, you can monitor this event and compare the Central Access Policy SID in “**New Security Descriptor**” to see if it matches the expected policy. \ No newline at end of file +- If you have specific files, folders, or entire systems to which a specific Central Access Policy should be applied, you can monitor this event and compare the Central Access Policy SID in "**New Security Descriptor**" to see if it matches the expected policy.