sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Code
ac92f2d34a
samba-mirror/librpc/idl/windows_event_ids.idl

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

53 lines
1.8 KiB
Plaintext
Raw Normal View History

idl: Add Windows event code ids Add idl definitions for Windows Event Code Ids, and Logon Types. This intial commit adds: Event Ids 4264 Successful logon 4625 Unsuccessful logon Logon Types 2 Interactive 3 Network 4 Batch 5 Service 7 Unlock 8 NetworkCleartext 9 NewCredentials 10 RemoteInteractive 11 CachedInteractive The intention is to add Windows Event Codes to the JSON log messages, to provide a common event identifier in mixed Windows and Samba networks. And to assist security personnel with a windows background. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-13 00:17:44 +03:00
/*
IDL constants for windows event codes.
*/
[
pointer_default(unique)
]
interface windows_events
{
typedef [v1_enum,public] enum {
s4 group_audit: Add Windows Event Id's to Group membership changes Generate a GroupChange event when a user is created with a PrimaryGroup membership. Log the windows event id in the JSON GroupChange message. Event Id's supported are: 4728 A member was added to a security enabled global group 4729 A member was removed from a security enabled global group 4732 A member was added to a security enabled local group 4733 A member was removed from a security enabled local group 4746 A member was added to a security disabled local group 4747 A member was removed from a security disabled local group 4751 A member was added to a security disabled global group 4752 A member was removed from a security disabled global group 4756 A member was added to a security enabled universal group 4757 A member was removed from a security enabled universal group 4761 A member was added to a security disabled universal group 4762 A member was removed from a security disabled universal group Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-18 23:08:22 +03:00
EVT_ID_NONE = 0,
EVT_ID_SUCCESSFUL_LOGON = 4624,
EVT_ID_UNSUCCESSFUL_LOGON = 4625,
EVT_ID_PASSWORD_CHANGE = 4723,
EVT_ID_PASSWORD_RESET = 4724,
EVT_ID_USER_ADDED_TO_GLOBAL_SEC_GROUP = 4728,
EVT_ID_USER_REMOVED_FROM_GLOBAL_SEC_GROUP = 4729,
EVT_ID_USER_ADDED_TO_LOCAL_SEC_GROUP = 4732,
EVT_ID_USER_REMOVED_FROM_LOCAL_SEC_GROUP = 4733,
EVT_ID_USER_ADDED_TO_LOCAL_GROUP = 4746,
EVT_ID_USER_REMOVED_FROM_LOCAL_GROUP = 4747,
EVT_ID_USER_ADDED_TO_GLOBAL_GROUP = 4751,
EVT_ID_USER_REMOVED_FROM_GLOBAL_GROUP = 4752,
EVT_ID_USER_ADDED_TO_UNIVERSAL_SEC_GROUP = 4756,
EVT_ID_USER_REMOVED_FROM_UNIVERSAL_SEC_GROUP = 4757,
EVT_ID_USER_ADDED_TO_UNIVERSAL_GROUP = 4761,
EVT_ID_USER_REMOVED_FROM_UNIVERSAL_GROUP = 4762
idl: Add Windows event code ids Add idl definitions for Windows Event Code Ids, and Logon Types. This intial commit adds: Event Ids 4264 Successful logon 4625 Unsuccessful logon Logon Types 2 Interactive 3 Network 4 Batch 5 Service 7 Unlock 8 NetworkCleartext 9 NewCredentials 10 RemoteInteractive 11 CachedInteractive The intention is to add Windows Event Codes to the JSON log messages, to provide a common event identifier in mixed Windows and Samba networks. And to assist security personnel with a windows background. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-13 00:17:44 +03:00
} event_id_type;
librpc/idl: Add authentication policy event IDs Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-14 02:28:40 +03:00
/* See https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos#BKMK_ErrorandEvents */
typedef [v1_enum,public] enum {
AUTH_EVT_ID_NONE = 0,
AUTH_EVT_ID_NTLM_DEVICE_RESTRICTION = 101,
AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION = 105,
AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION_AUDIT = 305,
AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION = 106,
AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION_AUDIT = 306
} auth_event_id_type;
idl: Add Windows event code ids Add idl definitions for Windows Event Code Ids, and Logon Types. This intial commit adds: Event Ids 4264 Successful logon 4625 Unsuccessful logon Logon Types 2 Interactive 3 Network 4 Batch 5 Service 7 Unlock 8 NetworkCleartext 9 NewCredentials 10 RemoteInteractive 11 CachedInteractive The intention is to add Windows Event Codes to the JSON log messages, to provide a common event identifier in mixed Windows and Samba networks. And to assist security personnel with a windows background. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-13 00:17:44 +03:00
typedef [v1_enum,public] enum {
EVT_LOGON_INTERACTIVE = 2,
EVT_LOGON_NETWORK = 3,
EVT_LOGON_BATCH = 4,
EVT_LOGON_SERVICE = 5,
EVT_LOGON_UNLOCK = 7,
EVT_LOGON_NETWORK_CLEAR_TEXT = 8,
EVT_LOGON_NEW_CREDENTIALS = 9,
EVT_LOGON_REMOTE_INTERACTIVE = 10,
EVT_LOGON_CACHED_INTERACTIVE = 11
} event_logon_type;
}
Copy Permalink