|
|
//*********************************************//*** MSV1_0 SSP: MSV1_0//*********************************************#pragma classflags("forceupdate")#pragma namespace ("\\\\.\\Root\\WMI")
[Dynamic, Description("NTLM Security Protocol") : amended, Guid("{C92CF544-91B3-4dc0-8E11-C580339A0BF8}"), locale("MS\\0x409")]class MSV1_0Trace:EventTrace{};
[Dynamic, Description("NTLM Server Accept") : amended, Guid("{94d4c9eb-0d01-41ae-99e8-15b26b593a83}"), DisplayName("NtlmServerAccept"), locale("MS\\0x409")]class NtlmServerAccept:MSV1_0Trace{
};
[Dynamic, Description("NTLM Server Accept") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409")]class NtlmServerAccept_Start:NtlmServerAccept{ [WmiDataId(1), Description("Stage Hint") : amended, read] uint32 StageHint; [WmiDataId(2), Description("In-Context") : amended, pointer, read] uint32 InContext;};
[Dynamic, Description("NTLM Server Accept") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409")]class NtlmServerAccept_End:NtlmServerAccept{ [WmiDataId(1), Description("Stage Hint") : amended, read] uint32 StageHint; [WmiDataId(2), Description("In-Context") : amended, pointer, read] uint32 InContext; [WmiDataId(3), Description("Out-Context") : amended, pointer, read] uint32 OutContext; [WmiDataId(4), Description("Status") : amended, read] uint32 Status;};
[Dynamic, Description("NTLM Server Accept") : amended, EventType(0), EventTypeName("Info"), locale("MS\\0x409")]class NtlmServerAccept_Info:NtlmServerAccept{ [WmiDataId(1), Description("Stage Hint") : amended, read] uint32 StageHint; [WmiDataId(2), Description("In-Context") : amended, pointer, read] uint32 InContext; [WmiDataId(3), Description("Out-Context") : amended, pointer, read] uint32 OutContext; [WmiDataId(4), Description("Flags") : amended, read] uint32 Flags; [WmiDataId(5), Description("Client User Name") : amended, StringTermination("Counted"), format("w"), read] string UserName; [WmiDataId(6), Description("Client Domain Name") : amended, StringTermination("Counted"), format("w"), read] string DomainName; [WmiDataId(7), Description("Client Workstation") : amended, StringTermination("Counted"), format("w"), read] string Workstation;};
[Dynamic, Description("NTLM Client Initialize") : amended, Guid("{6df28b22-73be-45cc-ba80-8b332b35a21d}"), DisplayName("NtlmClientInitialize"), locale("MS\\0x409")]class NtlmClientInitialize:MSV1_0Trace{
};
[Dynamic, Description("NTLM Client Initialize") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409")]class NtlmClientInitialize_Start:NtlmClientInitialize{ [WmiDataId(1), Description("Stage Hint") : amended, read] uint32 StageHint; [WmiDataId(2), Description("In-Context") : amended, pointer, read] uint32 InContext;};
[Dynamic, Description("NTLM Client Initialize") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409")]class NtlmClientInitialize_End:NtlmClientInitialize{ [WmiDataId(1), Description("Stage Hint") : amended, read] uint32 StageHint; [WmiDataId(2), Description("In-Context") : amended, pointer, read] uint32 InContext; [WmiDataId(3), Description("Out-Context") : amended, pointer, read] uint32 OutContext; [WmiDataId(4), Description("Status") : amended, read] uint32 Status;};
[Dynamic, Description("NTLM Logon User") : amended, Guid("{19196b33-a302-4c12-9d5a-eac149e93c46}"), DisplayName("NtlmLogonUser"), locale("MS\\0x409")]class NtlmLogonUser:MSV1_0Trace{
};
[Dynamic, Description("NTLM Logon User") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409")]class NtlmLogonUser_Start:NtlmLogonUser{};
[Dynamic, Description("NTLM Logon User") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409")]class NtlmLogonUser_End:NtlmLogonUser{ [WmiDataId(1), Description("Status") : amended, read] uint32 Status; [WmiDataId(2), Description("Logon Type") : amended, read] uint32 LogonType; [WmiDataId(3), Description("User Name") : amended, StringTermination("Counted"), format("w"), read] string UserName; [WmiDataId(4), Description("Domain Name") : amended, StringTermination("Counted"), format("w"), read] string DomainName;};
[Dynamic, Description("NTLM Validate Credentials") : amended, Guid("{34d84181-c28a-41d8-bb9e-995190df83df}"), DisplayName("NtlmValidateUser"), locale("MS\\0x409")]class NtlmValidateUser:MSV1_0Trace{
};
[Dynamic, Description("NTLM Validate Credentials") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409")]class NtlmValidateUser_Start:NtlmValidateUser{};
[Dynamic, Description("NTLM Validate Credentials") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409")]class NtlmValidateUser_End:NtlmValidateUser{ [WmiDataId(1), Description("Success Bitmask") : amended, read] uint32 Success; [WmiDataId(2), Description("Logon Server") : amended, StringTermination("Counted"), format("w"), read] string LogonServer; [WmiDataId(3), Description("Domain Name") : amended, StringTermination("Counted"), format("w"), read] string LogonDomain; [WmiDataId(4), Description("User Name") : amended, StringTermination("Counted"), format("w"), read] string UserName; [WmiDataId(5), Description("Logon Workstation") : amended, StringTermination("Counted"), format("w"), read] string Workstation;};
|
