windows-server-2003/ds/published/inc/lmaudit.w

/*++ BUILD Version: 0003    // Increment this if a change has global effects

Copyright (c) 1991-1999  Microsoft Corporation

Module Name:

    lmaudit.h

Abstract:

    This module defines the API function prototypes and data structures
    for the following groups of NT API functions:
        NetAudit

Environment:

    User Mode - Win32

Notes:

    You must include NETCONS.H before this file, since this file depends
    on values defined in NETCONS.H.

--*/

#ifndef _LMAUDIT_
#define _LMAUDIT_

#if _MSC_VER > 1000
#pragma once
#endif

#ifdef __cplusplus
extern "C" {
#endif

#ifndef _LMHLOGDEFINED_
#define _LMHLOGDEFINED_

typedef struct _HLOG {
     DWORD          time;
     DWORD          last_flags;
     DWORD          offset;
     DWORD          rec_offset;
} HLOG, *PHLOG, *LPHLOG;

#define LOGFLAGS_FORWARD	0
#define LOGFLAGS_BACKWARD	0x1
#define LOGFLAGS_SEEK		0x2

#endif

//
// Function Prototypes - Audit
//

NET_API_STATUS NET_API_FUNCTION
NetAuditClear (
    IN  LPCWSTR  server OPTIONAL,
    IN  LPCWSTR  backupfile OPTIONAL,
    IN  LPCWSTR  service OPTIONAL  // WARNING: buggy support before LM 2.0C!!
    );

NET_API_STATUS NET_API_FUNCTION
NetAuditRead (
    IN  LPCWSTR  server OPTIONAL,
    IN  LPCWSTR  service OPTIONAL,  // WARNING: buggy support before LM 2.0C!!
    IN  LPHLOG   auditloghandle,
    IN  DWORD    offset,
    IN  LPDWORD  reserved1 OPTIONAL,
    IN  DWORD   reserved2,
    IN  DWORD   offsetflag,
    OUT LPBYTE  *bufptr,
    IN  DWORD   prefmaxlen,
    OUT LPDWORD bytesread,
    OUT LPDWORD totalavailable
    );

NET_API_STATUS NET_API_FUNCTION
NetAuditWrite (
    IN  DWORD    type,
    IN  LPBYTE   buf,
    IN  DWORD    numbytes,
    IN  LPCWSTR  service OPTIONAL,
    IN  LPBYTE   reserved OPTIONAL
    );


//
// Data Structures - Audit
//

typedef struct _AUDIT_ENTRY {
     DWORD          ae_len;
     DWORD          ae_reserved;
     DWORD          ae_time;
     DWORD          ae_type;
     DWORD          ae_data_offset;  /* Offset from beginning
                              address of audit_entry */
     DWORD          ae_data_size;  // byte count of ae_data area (not incl pad).
} AUDIT_ENTRY, *PAUDIT_ENTRY, *LPAUDIT_ENTRY;

#define REVISED_AUDIT_ENTRY_STRUCT


typedef struct _AE_SRVSTATUS {
     DWORD	    ae_sv_status;
} AE_SRVSTATUS, *PAE_SRVSTATUS, *LPAE_SRVSTATUS;

typedef struct _AE_SESSLOGON {
     DWORD          ae_so_compname;
     DWORD          ae_so_username;
     DWORD          ae_so_privilege;
} AE_SESSLOGON, *PAE_SESSLOGON, *LPAE_SESSLOGON;

typedef struct _AE_SESSLOGOFF {
     DWORD          ae_sf_compname;
     DWORD          ae_sf_username;
     DWORD          ae_sf_reason;
} AE_SESSLOGOFF, *PAE_SESSLOGOFF, *LPAE_SESSLOGOFF;

typedef struct _AE_SESSPWERR {
     DWORD          ae_sp_compname;
     DWORD          ae_sp_username;
} AE_SESSPWERR, *PAE_SESSPWERR, *LPAE_SESSPWERR;

typedef struct _AE_CONNSTART {
     DWORD          ae_ct_compname;
     DWORD          ae_ct_username;
     DWORD          ae_ct_netname;
     DWORD          ae_ct_connid;
} AE_CONNSTART, *PAE_CONNSTART, *LPAE_CONNSTART;

typedef struct _AE_CONNSTOP {
     DWORD          ae_cp_compname;
     DWORD          ae_cp_username;
     DWORD          ae_cp_netname;
     DWORD          ae_cp_connid;
     DWORD          ae_cp_reason;
} AE_CONNSTOP, *PAE_CONNSTOP, *LPAE_CONNSTOP;

typedef struct _AE_CONNREJ {
     DWORD          ae_cr_compname;
     DWORD          ae_cr_username;
     DWORD          ae_cr_netname;
     DWORD          ae_cr_reason;
} AE_CONNREJ, *PAE_CONNREJ, *LPAE_CONNREJ;

typedef struct _AE_RESACCESS {
     DWORD          ae_ra_compname;
     DWORD          ae_ra_username;
     DWORD          ae_ra_resname;
     DWORD          ae_ra_operation;
     DWORD          ae_ra_returncode;
     DWORD          ae_ra_restype;
     DWORD          ae_ra_fileid;
} AE_RESACCESS, *PAE_RESACCESS, *LPAE_RESACCESS;

typedef struct _AE_RESACCESSREJ {
     DWORD          ae_rr_compname;
     DWORD          ae_rr_username;
     DWORD          ae_rr_resname;
     DWORD          ae_rr_operation;
} AE_RESACCESSREJ, *PAE_RESACCESSREJ, *LPAE_RESACCESSREJ;

typedef struct _AE_CLOSEFILE {
     DWORD          ae_cf_compname;
     DWORD          ae_cf_username;
     DWORD          ae_cf_resname;
     DWORD          ae_cf_fileid;
     DWORD          ae_cf_duration;
     DWORD          ae_cf_reason;
} AE_CLOSEFILE, *PAE_CLOSEFILE, *LPAE_CLOSEFILE;

typedef struct _AE_SERVICESTAT {
     DWORD          ae_ss_compname;
     DWORD          ae_ss_username;
     DWORD          ae_ss_svcname;
     DWORD          ae_ss_status;
     DWORD          ae_ss_code;
     DWORD          ae_ss_text;
     DWORD          ae_ss_returnval;
} AE_SERVICESTAT, *PAE_SERVICESTAT, *LPAE_SERVICESTAT;

typedef struct _AE_ACLMOD {
     DWORD          ae_am_compname;
     DWORD          ae_am_username;
     DWORD          ae_am_resname;
     DWORD          ae_am_action;
     DWORD          ae_am_datalen;
} AE_ACLMOD, *PAE_ACLMOD, *LPAE_ACLMOD;

typedef struct _AE_UASMOD {
     DWORD          ae_um_compname;
     DWORD          ae_um_username;
     DWORD          ae_um_resname;
     DWORD          ae_um_rectype;
     DWORD          ae_um_action;
     DWORD          ae_um_datalen;
} AE_UASMOD, *PAE_UASMOD, *LPAE_UASMOD;

typedef struct _AE_NETLOGON {
     DWORD          ae_no_compname;
     DWORD          ae_no_username;
     DWORD          ae_no_privilege;
     DWORD          ae_no_authflags;
} AE_NETLOGON, *PAE_NETLOGON, *LPAE_NETLOGON;

typedef struct _AE_NETLOGOFF {
     DWORD          ae_nf_compname;
     DWORD          ae_nf_username;
     DWORD          ae_nf_reserved1;
     DWORD          ae_nf_reserved2;
} AE_NETLOGOFF, *PAE_NETLOGOFF, *LPAE_NETLOGOFF;

typedef struct _AE_ACCLIM {
     DWORD          ae_al_compname;
     DWORD          ae_al_username;
     DWORD          ae_al_resname;
     DWORD          ae_al_limit;
} AE_ACCLIM, *PAE_ACCLIM, *LPAE_ACCLIM;

#define ACTION_LOCKOUT          00
#define ACTION_ADMINUNLOCK      01

typedef struct _AE_LOCKOUT {
    DWORD           ae_lk_compname;     // Ptr to computername of client.
    DWORD           ae_lk_username;     // Ptr to username of client (NULL
                                        //  if same as computername).
    DWORD           ae_lk_action;       // Action taken on account:
                                        // 0 means locked out, 1 means not.
    DWORD           ae_lk_bad_pw_count; // Bad password count at the time
                                        // of lockout.
} AE_LOCKOUT, *PAE_LOCKOUT, *LPAE_LOCKOUT;

typedef struct _AE_GENERIC {
     DWORD          ae_ge_msgfile;
     DWORD          ae_ge_msgnum;
     DWORD          ae_ge_params;
     DWORD          ae_ge_param1;
     DWORD          ae_ge_param2;
     DWORD          ae_ge_param3;
     DWORD          ae_ge_param4;
     DWORD          ae_ge_param5;
     DWORD          ae_ge_param6;
     DWORD          ae_ge_param7;
     DWORD          ae_ge_param8;
     DWORD          ae_ge_param9;
} AE_GENERIC, *PAE_GENERIC, *LPAE_GENERIC;

//
// Special Values and Constants - Audit
//

//
// 	Audit entry types (field ae_type in audit_entry).
//

#define AE_SRVSTATUS	0
#define AE_SESSLOGON	1
#define AE_SESSLOGOFF	2
#define AE_SESSPWERR	3
#define AE_CONNSTART	4
#define AE_CONNSTOP	5
#define AE_CONNREJ	6
#define AE_RESACCESS	7
#define AE_RESACCESSREJ	8
#define AE_CLOSEFILE	9
#define AE_SERVICESTAT	11
#define AE_ACLMOD	12
#define AE_UASMOD	13
#define AE_NETLOGON	14
#define AE_NETLOGOFF	15
#define AE_NETLOGDENIED 16
#define AE_ACCLIMITEXCD 17
#define AE_RESACCESS2	18
#define AE_ACLMODFAIL	19
#define AE_LOCKOUT      20
#define AE_GENERIC_TYPE 21
//
//	Values for ae_ss_status field of ae_srvstatus.
//

#define AE_SRVSTART	0
#define AE_SRVPAUSED	1
#define AE_SRVCONT	2
#define AE_SRVSTOP	3

//
// 	Values for ae_so_privilege field of ae_sesslogon.
//

#define AE_GUEST	0		
#define AE_USER		1
#define AE_ADMIN	2

//
//	Values for various ae_XX_reason fields.
//

#define AE_NORMAL	0		
#define AE_USERLIMIT	0
#define AE_GENERAL	0
#define AE_ERROR	1
#define AE_SESSDIS	1
#define AE_BADPW	1
#define AE_AUTODIS	2
#define AE_UNSHARE	2
#define AE_ADMINPRIVREQD 2
#define AE_ADMINDIS	3
#define AE_NOACCESSPERM 3
#define AE_ACCRESTRICT	4

#define	AE_NORMAL_CLOSE	0
#define	AE_SES_CLOSE	1
#define	AE_ADMIN_CLOSE	2

//
// Values for xx_subreason fields.
//

#define AE_LIM_UNKNOWN	    0
#define AE_LIM_LOGONHOURS   1
#define AE_LIM_EXPIRED	    2
#define AE_LIM_INVAL_WKSTA  3
#define AE_LIM_DISABLED     4
#define AE_LIM_DELETED	    5

//
// Values for xx_action fields
//

#define AE_MOD		0
#define AE_DELETE	1
#define AE_ADD		2

//
// Types of UAS record for um_rectype field
//

#define AE_UAS_USER	    0
#define AE_UAS_GROUP	    1
#define AE_UAS_MODALS	    2

//
// Bitmasks for auditing events
//
// The parentheses around the hex constants broke h_to_inc
// and have been purged from the face of the earth.
//

#define SVAUD_SERVICE           0x1
#define SVAUD_GOODSESSLOGON     0x6
#define SVAUD_BADSESSLOGON      0x18
#define SVAUD_SESSLOGON         (SVAUD_GOODSESSLOGON | SVAUD_BADSESSLOGON)
#define SVAUD_GOODNETLOGON      0x60
#define SVAUD_BADNETLOGON       0x180
#define SVAUD_NETLOGON          (SVAUD_GOODNETLOGON | SVAUD_BADNETLOGON)
#define SVAUD_LOGON             (SVAUD_NETLOGON | SVAUD_SESSLOGON)
#define SVAUD_GOODUSE           0x600
#define SVAUD_BADUSE            0x1800
#define SVAUD_USE               (SVAUD_GOODUSE | SVAUD_BADUSE)
#define SVAUD_USERLIST          0x2000
#define SVAUD_PERMISSIONS       0x4000
#define SVAUD_RESOURCE          0x8000
#define SVAUD_LOGONLIM		0x00010000

//
// Resource access audit bitmasks.
//

#define AA_AUDIT_ALL	    0x0001
#define AA_A_OWNER	    0x0004
#define AA_CLOSE	    0x0008
#define AA_S_OPEN	    0x0010
#define AA_S_WRITE	    0x0020
#define AA_S_CREATE	    0x0020
#define AA_S_DELETE	    0x0040
#define AA_S_ACL	    0x0080
#define AA_S_ALL	    ( AA_S_OPEN | AA_S_WRITE | AA_S_DELETE | AA_S_ACL)
#define AA_F_OPEN	    0x0100
#define AA_F_WRITE	    0x0200
#define AA_F_CREATE	    0x0200
#define AA_F_DELETE	    0x0400
#define AA_F_ACL	    0x0800
#define AA_F_ALL	    ( AA_F_OPEN | AA_F_WRITE | AA_F_DELETE | AA_F_ACL)

// Pinball-specific
#define AA_A_OPEN	    0x1000
#define AA_A_WRITE	    0x2000
#define AA_A_CREATE	    0x2000
#define AA_A_DELETE	    0x4000
#define AA_A_ACL	    0x8000
#define AA_A_ALL	    ( AA_F_OPEN | AA_F_WRITE | AA_F_DELETE | AA_F_ACL)


#ifdef __cplusplus
}
#endif

#endif  // _LMAUDIT_