sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Code
8a313bbdd5
samba-mirror/librpc/idl/windows_event_ids.idl

30 lines
633 B
Plaintext
Raw Normal View History

idl: Add Windows event code ids Add idl definitions for Windows Event Code Ids, and Logon Types. This intial commit adds: Event Ids 4264 Successful logon 4625 Unsuccessful logon Logon Types 2 Interactive 3 Network 4 Batch 5 Service 7 Unlock 8 NetworkCleartext 9 NewCredentials 10 RemoteInteractive 11 CachedInteractive The intention is to add Windows Event Codes to the JSON log messages, to provide a common event identifier in mixed Windows and Samba networks. And to assist security personnel with a windows background. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-13 00:17:44 +03:00
/*
IDL constants for windows event codes.
*/
[
pointer_default(unique)
]
interface windows_events
{
typedef [v1_enum,public] enum {
EVT_ID_SUCCESSFUL_LOGON = 4624,
dsdb audit_log: Add windows event codes to password changes Add a new "eventId" element to the PasswordChange JSON log messages. This contains a Windows Event Code Id either: 4723 Password changed 4724 Password reset Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-14 01:09:20 +03:00
EVT_ID_UNSUCCESSFUL_LOGON = 4625,
EVT_ID_PASSWORD_CHANGE = 4723,
EVT_ID_PASSWORD_RESET = 4724
idl: Add Windows event code ids Add idl definitions for Windows Event Code Ids, and Logon Types. This intial commit adds: Event Ids 4264 Successful logon 4625 Unsuccessful logon Logon Types 2 Interactive 3 Network 4 Batch 5 Service 7 Unlock 8 NetworkCleartext 9 NewCredentials 10 RemoteInteractive 11 CachedInteractive The intention is to add Windows Event Codes to the JSON log messages, to provide a common event identifier in mixed Windows and Samba networks. And to assist security personnel with a windows background. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-13 00:17:44 +03:00
} event_id_type;
typedef [v1_enum,public] enum {
EVT_LOGON_INTERACTIVE = 2,
EVT_LOGON_NETWORK = 3,
EVT_LOGON_BATCH = 4,
EVT_LOGON_SERVICE = 5,
EVT_LOGON_UNLOCK = 7,
EVT_LOGON_NETWORK_CLEAR_TEXT = 8,
EVT_LOGON_NEW_CREDENTIALS = 9,
EVT_LOGON_REMOTE_INTERACTIVE = 10,
EVT_LOGON_CACHED_INTERACTIVE = 11
} event_logon_type;
}
Copy Permalink