725 lines
14 KiB
Plaintext
725 lines
14 KiB
Plaintext
#pragma classflags("forceupdate")
|
|
#pragma namespace ("\\\\.\\Root\\WMI")
|
|
|
|
[Dynamic,
|
|
Description("Local Security Authority (LSA)") : amended,
|
|
Guid("{cc85922f-db41-11d2-9244-006008269001}"),
|
|
locale("MS\\0x409")]
|
|
class MSLSATrace: EventTrace
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QuerySecret") : amended,
|
|
Guid("{cc85922e-db41-11d2-9244-006008269001}"),
|
|
DisplayName("QuerySecret"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QuerySecret:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QuerySecret") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QuerySecret_Start:QuerySecret
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QuerySecret") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QuerySecret_End:QuerySecret
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("Close") : amended,
|
|
Guid("{2306fe3b-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("Close"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class Close:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("Close") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class Close_Start:Close
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("Close") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class Close_End:Close
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenPolicy") : amended,
|
|
Guid("{2306fe3a-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("OpenPolicy"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpenPolicy:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenPolicy") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpenPolicy_Start:OpenPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenPolicy") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpenPolicy_End:OpenPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInformationPolicy") : amended,
|
|
Guid("{2306fe39-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("QueryInfoPolicy"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryInfoPolicy:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInformationPolicy") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryInfoPolicy_Start:QueryInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInformationPolicy") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryInfoPolicy_End:QueryInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationPolicy") : amended,
|
|
Guid("{2306fe38-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("SetInfoPolicy"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoPolicy:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationPolicy") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoPolicy_Start:SetInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationPolicy") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoPolicy_End:SetInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("EnumerateTrustedDomains") : amended,
|
|
Guid("{2306fe37-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("EnumTrustedDoms"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class EnumTrustedDoms:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("EnumerateTrustedDomains") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class EnumTrustedDoms_Start:EnumTrustedDoms
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("EnumerateTrustedDomains") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class EnumTrustedDoms_End:EnumTrustedDoms
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupNames") : amended,
|
|
Guid("{2306fe36-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("LookupNames"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class LookupNames:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupNames") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class LookupNames_Start:LookupNames
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupNames") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class LookupNames_End:LookupNames
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupSids") : amended,
|
|
Guid("{2306fe35-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("LookupSids"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class LookupSids:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupSids") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class LookupSids_Start:LookupSids
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupSids") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class LookupSids_End:LookupSids
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenTrustedDomain") : amended,
|
|
Guid("{2306fe34-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("OpenTrustedDomain"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpenTrustedDomain:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenTrustedDomain") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpenTrustedDomain_Start:OpenTrustedDomain
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenTrustedDomain") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpenTrustedDomain_End:OpenTrustedDomain
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInfoTrustedDomain") : amended,
|
|
Guid("{2306fe33-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("QryInfoTrustDom"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QryInfoTrustDom:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInfoTrustedDomain") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QryInfoTrustDom_Start:QryInfoTrustDom
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInfoTrustedDomain") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QryInfoTrustDom_End:QryInfoTrustDom
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationTrustedDomain") : amended,
|
|
Guid("{2306fe32-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("SetInfoTrustedDom"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoTrustedDom:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationTrustedDomain") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoTrustedDom_Start:SetInfoTrustedDom
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationTrustedDomain") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoTrustedDom_End:SetInfoTrustedDom
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInformationPolicy2") : amended,
|
|
Guid("{2306fe31-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("QueryInfoPolicy2"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryInfoPolicy2:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInformationPolicy2") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryInfoPolicy2_Start:QueryInfoPolicy2
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryInformationPolicy2") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryInfoPolicy2_End:QueryInfoPolicy2
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationPolicy2") : amended,
|
|
Guid("{2306fe30-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("SetInfoPolicy2"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoPolicy2:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationPolicy2") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoPolicy2_Start:SetInfoPolicy2
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetInformationPolicy2") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetInfoPolicy2_End:SetInfoPolicy2
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryTrustedDomainInfoByName") : amended,
|
|
Guid("{2306fe2f-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("QryTrstDomByNam"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QryTrstDomByNam:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryTrustedDomainInfoByName") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QryTrstDomByNam_Start:QryTrstDomByNam
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryTrustedDomainInfoByName") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QryTrstDomByNam_End:QryTrstDomByNam
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetTrustedDomainInfoByName") : amended,
|
|
Guid("{2306fe2e-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("SetTrstedDomInfoByNam"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetTrstedDomInfoByNam:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetTrustedDomainInfoByName") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetTrstedDomInfoByNam_Start:SetTrstedDomInfoByNam
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetTrustedDomainInfoByName") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetTrstedDomInfoByNam_End:SetTrstedDomInfoByNam
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("EnumerateTrustedDomainsEx") : amended,
|
|
Guid("{2306fe2d-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("EnumTrstedDomEx"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class EnumTrstedDomEx:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("EnumerateTrustedDomainsEx") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class EnumTrstedDomEx_Start:EnumTrstedDomEx
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("EnumerateTrustedDomainsEx") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class EnumTrstedDomEx_End:EnumTrstedDomEx
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("CreateTrustedDomainEx") : amended,
|
|
Guid("{2306fe2c-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("CreateTrustedDomEx"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class CreateTrustedDomEx:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("CreateTrustedDomainEx") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class CreateTrustedDomEx_Start:CreateTrustedDomEx
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("CreateTrustedDomainEx") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class CreateTrustedDomEx_End:CreateTrustedDomEx
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryDomainInformationPolicy") : amended,
|
|
Guid("{2306fe2b-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("QueryDomainInfoPolicy"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryDomainInfoPolicy:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryDomainInformationPolicy") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryDomainInfoPolicy_Start:QueryDomainInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryDomainInformationPolicy") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryDomainInfoPolicy_End:QueryDomainInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetDomainInformationPolicy") : amended,
|
|
Guid("{2306fe2a-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("SetDomainInfoPolicy"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetDomainInfoPolicy:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetDomainInformationPolicy") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetDomainInfoPolicy_Start:SetDomainInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetDomainInformationPolicy") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetDomainInfoPolicy_End:SetDomainInfoPolicy
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenTrustedDomainByName") : amended,
|
|
Guid("{2306fe29-dbf6-11d2-9244-006008269001}"),
|
|
DisplayName("OpTrustedDomByName"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpTrustedDomByName:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenTrustedDomainByName") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpTrustedDomByName_Start:OpTrustedDomByName
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("OpenTrustedDomainByName") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class OpTrustedDomByName_End:OpTrustedDomByName
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryForestTrustInfo") : amended,
|
|
Guid("{e28ee0eb-6181-49df-b859-2f3fd289a2d1}"),
|
|
DisplayName("OpTrustedDomByName"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryForestTrustInfo:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryForestTrustInfo") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryForestTrustInfo_Start:QueryForestTrustInfo
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("QueryForestTrustInfo") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class QueryForestTrustInfo_End:QueryForestTrustInfo
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetForestTrustInfo") : amended,
|
|
Guid("{3d2c9e3e-bb19-4617-8489-cabb9787de7d}"),
|
|
DisplayName("OpTrustedDomByName"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetForestTrustInfo:MSLSATrace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetForestTrustInfo") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetForestTrustInfo_Start:SetForestTrustInfo
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("SetForestTrustInfo") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class SetForestTrustInfo_End:SetForestTrustInfo
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("LookupIsolatedNameInTrustedDomains") : amended,
|
|
Guid("{2484dc26-49d3-4085-a6e4-4972115cb3c0}"),
|
|
DisplayNames("LookupIsolatedNameInTrustedDomains"),
|
|
locale("MS\\0x409")]
|
|
class MSLSA_LookupIsolatedNameInTrustedDomains: MSLSATrace
|
|
{
|
|
};
|
|
[Dynamic,
|
|
Description("LookupIsolatedNameInTrustedDomains_TypeGroup1") : amended,
|
|
EventType{1, 2},
|
|
EventTypeName{"Start", "End"} : amended,
|
|
locale("MS\\0x409")
|
|
]
|
|
class MSLSA_LookupIsolatedNameInTrustedDomains_TypeGroup1:MSLSA_LookupIsolatedNameInTrustedDomains
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Isolated Name") : amended,
|
|
StringTermination("NullTerminated"),
|
|
format("w"),
|
|
read]
|
|
string IsolatedName;
|
|
|
|
[WmiDataId(2),
|
|
Description("Client Network Address") : amended,
|
|
StringTermination("NullTerminated"),
|
|
format("w"),
|
|
read]
|
|
string ClientNetworkAddress;
|
|
|
|
};
|