You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
286 lines
6.3 KiB
286 lines
6.3 KiB
//*********************************************
|
|
//*** MSV1_0 SSP: MSV1_0
|
|
//*********************************************
|
|
#pragma classflags("forceupdate")
|
|
#pragma namespace ("\\\\.\\Root\\WMI")
|
|
|
|
[Dynamic,
|
|
Description("NTLM Security Protocol") : amended,
|
|
Guid("{C92CF544-91B3-4dc0-8E11-C580339A0BF8}"),
|
|
locale("MS\\0x409")]
|
|
class MSV1_0Trace:EventTrace
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Server Accept") : amended,
|
|
Guid("{94d4c9eb-0d01-41ae-99e8-15b26b593a83}"),
|
|
DisplayName("NtlmServerAccept"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmServerAccept:MSV1_0Trace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Server Accept") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmServerAccept_Start:NtlmServerAccept
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Stage Hint") : amended,
|
|
read]
|
|
uint32 StageHint;
|
|
[WmiDataId(2),
|
|
Description("In-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 InContext;
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Server Accept") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmServerAccept_End:NtlmServerAccept
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Stage Hint") : amended,
|
|
read]
|
|
uint32 StageHint;
|
|
[WmiDataId(2),
|
|
Description("In-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 InContext;
|
|
[WmiDataId(3),
|
|
Description("Out-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 OutContext;
|
|
[WmiDataId(4),
|
|
Description("Status") : amended,
|
|
read]
|
|
uint32 Status;
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Server Accept") : amended,
|
|
EventType(0),
|
|
EventTypeName("Info"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmServerAccept_Info:NtlmServerAccept
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Stage Hint") : amended,
|
|
read]
|
|
uint32 StageHint;
|
|
[WmiDataId(2),
|
|
Description("In-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 InContext;
|
|
[WmiDataId(3),
|
|
Description("Out-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 OutContext;
|
|
[WmiDataId(4),
|
|
Description("Flags") : amended,
|
|
read]
|
|
uint32 Flags;
|
|
[WmiDataId(5),
|
|
Description("Client User Name") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string UserName;
|
|
[WmiDataId(6),
|
|
Description("Client Domain Name") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string DomainName;
|
|
[WmiDataId(7),
|
|
Description("Client Workstation") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string Workstation;
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Client Initialize") : amended,
|
|
Guid("{6df28b22-73be-45cc-ba80-8b332b35a21d}"),
|
|
DisplayName("NtlmClientInitialize"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmClientInitialize:MSV1_0Trace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Client Initialize") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmClientInitialize_Start:NtlmClientInitialize
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Stage Hint") : amended,
|
|
read]
|
|
uint32 StageHint;
|
|
[WmiDataId(2),
|
|
Description("In-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 InContext;
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Client Initialize") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmClientInitialize_End:NtlmClientInitialize
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Stage Hint") : amended,
|
|
read]
|
|
uint32 StageHint;
|
|
[WmiDataId(2),
|
|
Description("In-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 InContext;
|
|
[WmiDataId(3),
|
|
Description("Out-Context") : amended,
|
|
pointer,
|
|
read]
|
|
uint32 OutContext;
|
|
[WmiDataId(4),
|
|
Description("Status") : amended,
|
|
read]
|
|
uint32 Status;
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Logon User") : amended,
|
|
Guid("{19196b33-a302-4c12-9d5a-eac149e93c46}"),
|
|
DisplayName("NtlmLogonUser"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmLogonUser:MSV1_0Trace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Logon User") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmLogonUser_Start:NtlmLogonUser
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Logon User") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmLogonUser_End:NtlmLogonUser
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Status") : amended,
|
|
read]
|
|
uint32 Status;
|
|
[WmiDataId(2),
|
|
Description("Logon Type") : amended,
|
|
read]
|
|
uint32 LogonType;
|
|
[WmiDataId(3),
|
|
Description("User Name") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string UserName;
|
|
[WmiDataId(4),
|
|
Description("Domain Name") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string DomainName;
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Validate Credentials") : amended,
|
|
Guid("{34d84181-c28a-41d8-bb9e-995190df83df}"),
|
|
DisplayName("NtlmValidateUser"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmValidateUser:MSV1_0Trace
|
|
{
|
|
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Validate Credentials") : amended,
|
|
EventType(1),
|
|
EventTypeName("Start"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmValidateUser_Start:NtlmValidateUser
|
|
{
|
|
};
|
|
|
|
[Dynamic,
|
|
Description("NTLM Validate Credentials") : amended,
|
|
EventType(2),
|
|
EventTypeName("End"),
|
|
locale("MS\\0x409")
|
|
]
|
|
class NtlmValidateUser_End:NtlmValidateUser
|
|
{
|
|
[WmiDataId(1),
|
|
Description("Success Bitmask") : amended,
|
|
read]
|
|
uint32 Success;
|
|
[WmiDataId(2),
|
|
Description("Logon Server") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string LogonServer;
|
|
[WmiDataId(3),
|
|
Description("Domain Name") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string LogonDomain;
|
|
[WmiDataId(4),
|
|
Description("User Name") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string UserName;
|
|
[WmiDataId(5),
|
|
Description("Logon Workstation") : amended,
|
|
StringTermination("Counted"),
|
|
format("w"),
|
|
read]
|
|
string Workstation;
|
|
};
|
|
|