|
Object Open:
Object Server:Security
Object Type:File
Object Name:C:\ConfidentialFiles\ ProjectPlan.doc.txt
New Handle ID:1468
Operation ID:{0,1023441}
Process ID:1688
Windows Server 2003 adds this field:
Image File Name:C:\WINDOWS\ system32\ notepad.exe
All versions of Windows log these fields:
Primary User Name:administrator
Primary Domain:ELMW2
Primary Logon ID:(0x0,0x804C2)
Client User Name:-
Client Domain:-
Client Logon ID:-
AccessesDELETE
READ_CONTROL
ReadAttributes
Privileges-
Windows Server 2003 adds these fields:
Restricted Sid Count:0
Access Mask:0x10080
|
