Edit C:\Windows\SysWOW64\wbem\samsrv.mof
//********************************************* // *** Active Directory Service Provider: SAM //********************************************* #pragma classflags("forceupdate") #pragma namespace ("\\\\.\\Root\\WMI") [Dynamic, Description("Active Directory Domain Services: SAM") : amended, Guid("{8e598056-8993-11d2-819e-0000f875a064}"), locale("MS\\0x409")] class MSSAMTrace:EventTrace { }; [Dynamic, Description("SAM User Create") : amended, Guid("{39511dbe-899b-11d2-819e-0000f875a064}"), DisplayName("SamUserCreate"), locale("MS\\0x409") ] class SamUserCreate:MSSAMTrace { }; [Dynamic, Description("SAM User Create") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamUserCreate_Start:SamUserCreate { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM User Create") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamUserCreate_End:SamUserCreate { }; [Dynamic, Description("SAM Computer Create") : amended, Guid("{abb14b68-899b-11d2-819e-0000f875a064}"), DisplayName("SamCompCreate"), locale("MS\\0x409") ] class SamCompCreate:MSSAMTrace { }; [Dynamic, Description("SAM Computer Create"), EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamCompCreate_Start:SamCompCreate { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Computer Create") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamCompCreate_End:SamCompCreate { }; [Dynamic, Description("SAM Group Create") : amended, Guid("{c8eb5e5c-899c-11d2-819e-0000f875a064}"), DisplayName("SamGrpCreate"), locale("MS\\0x409") ] class SamGrpCreate:MSSAMTrace { }; [Dynamic, Description("SAM Group Create") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGrpCreate_Start:SamGrpCreate { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Group Create") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGrpCreate_End:SamGrpCreate { }; [Dynamic, Description("SAM Add Member to Group") : amended, Guid("{f9d2ba6a-899c-11d2-819e-0000f875a064}"), DisplayName("SamAddMemGrp"), locale("MS\\0x409") ] class SamAddMemGrp:MSSAMTrace { }; [Dynamic, Description("SAM Add Member to Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamAddMemGrp_Start:SamAddMemGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Add Member to Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamAddMemGrp_End:SamAddMemGrp { }; [Dynamic, Description("SAM Delete Member From Group") : amended, Guid("{250959aa-899d-11d2-819e-0000f875a064}"), DisplayName("SamDelMemGrp"), locale("MS\\0x409") ] class SamDelMemGrp:MSSAMTrace { }; [Dynamic, Description("SAM Delete Member From Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamDelMemGrp_Start:SamDelMemGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Delete Member From Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamDelMemGrp_End:SamDelMemGrp { }; [Dynamic, Description("SAM Password Change") : amended, Guid("{45fc997e-899d-11d2-819e-0000f875a064}"), DisplayName("SamPwdChng"), locale("MS\\0x409") ] class SamPwdChng:MSSAMTrace { }; [Dynamic, Description("SAM Password Change") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamPwdChng_Start:SamPwdChng { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Password Change") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamPwdChng_End:SamPwdChng { }; [Dynamic, Description("SAM User Password Set") : amended, Guid("{62bef71e-899d-11d2-819e-0000f875a064}"), DisplayName("SamUserPwdSet"), locale("MS\\0x409") ] class SamUserPwdSet:MSSAMTrace { }; [Dynamic, Description("SAM User Password Set") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamUserPwdSet_Start:SamUserPwdSet { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM User Password Set") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamUserPwdSet_End:SamUserPwdSet { }; [Dynamic, Description("SAM Computer Password Set") : amended, Guid("{880217b8-899d-11d2-819e-0000f875a064}"), DisplayName("SamCompPwdSet"), locale("MS\\0x409") ] class SamCompPwdSet:MSSAMTrace { }; [Dynamic, Description("SAM Computer Password Set") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamCompPwdSet_Start:SamCompPwdSet { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Computer Password Set") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamCompPwdSet_End:SamCompPwdSet { }; [Dynamic, Description("SAM Password Push PDC") : amended, Guid("{1f228de8-8a6c-11d2-819e-0000f875a064}"), DisplayName("SamPwdPushPdc"), locale("MS\\0x409") ] class SamPwdPushPdc:MSSAMTrace { }; [Dynamic, Description("SAM Password Push PDC") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamPwdPushPdc_Start:SamPwdPushPdc { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Password Push PDC") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamPwdPushPdc_End:SamPwdPushPdc { }; [Dynamic, Description("SAM Id By Name") : amended, Guid("{a41d90bc-899d-11d2-819e-0000f875a064}"), DisplayName("SamIdByName"), locale("MS\\0x409") ] class SamIdByName:MSSAMTrace { }; [Dynamic, Description("SAM Id By Name") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamIdByName_Start:SamIdByName { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Id By Name") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamIdByName_End:SamIdByName { }; [Dynamic, Description("SAM Name By Id") : amended, Guid("{25059476-899f-11d2-819e-0000f875a064}"), DisplayName("SamNameById"), locale("MS\\0x409") ] class SamNameById:MSSAMTrace { }; [Dynamic, Description("SAM Name By Id") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamNameById_Start:SamNameById { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Name By Id") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamNameById_End:SamNameById { }; [Dynamic, Description("SAM Connect") : amended, Guid("{8c89045c-3f5d-4289-939a-fb854000cb6b}"), DisplayName("SamConnect"), locale("MS\\0x409") ] class SamConnect:MSSAMTrace { }; [Dynamic, Description("SAM Connect") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamConnect_Start:SamConnect { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Connect") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamConnect_End:SamConnect { }; [Dynamic, Description("SAM Close Handle") : amended, Guid("{dbc0ceab-cff3-4c0f-85f2-0c2107142f36}"), DisplayName("SamCloseHandle"), locale("MS\\0x409") ] class SamCloseHandle:MSSAMTrace { }; [Dynamic, Description("SAM Close Handle") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamCloseHandle_Start:SamCloseHandle { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Close Handle") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamCloseHandle_End:SamCloseHandle { }; [Dynamic, Description("SAM Set Security Object") : amended, Guid("{74e10cbb-202e-4a97-871d-8547972b5141}"), DisplayName("SamSetSecurityObj"), locale("MS\\0x409") ] class SamSetSecurityObj:MSSAMTrace { }; [Dynamic, Description("SAM Set Security Object") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetSecurityObj_Start:SamSetSecurityObj { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Security Object") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetSecurityObj_End:SamSetSecurityObj { }; [Dynamic, Description("SAM Query Security Object") : amended, Guid("{676347f3-fd20-4e7d-90b1-77e35f84af9a}"), DisplayName("SamQuerySecurityObj"), locale("MS\\0x409") ] class SamQuerySecurityObj:MSSAMTrace { }; [Dynamic, Description("SAM Query Security Object") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamQuerySecurityObj_Start:SamQuerySecurityObj { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Query Security Object") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamQuerySecurityObj_End:SamQuerySecurityObj { }; [Dynamic, Description("SAM Shutdown SAM Server") : amended, Guid("{f8012701-7e99-49c5-b832-1db8bc4a610d}"), DisplayName("SamShutdownSamSrv"), locale("MS\\0x409") ] class SamShutdownSamSrv:MSSAMTrace { }; [Dynamic, Description("SAM Shutdown SAM Server") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamShutdownSamSrv_Start:SamShutdownSamSrv { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Shutdown SAM Server") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamShutdownSamSrv_End:SamShutdownSamSrv { }; [Dynamic, Description("SAM Lookup Domain In SAM Server") : amended, Guid("{a11e5d6b-353d-4bf6-97a8-ede4cba45524}"), DisplayName("SamLookupDomInSamSrv"), locale("MS\\0x409") ] class SamLookupDomInSamSrv:MSSAMTrace { }; [Dynamic, Description("SAM Lookup Domain In SAM Server") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamLookupDomInSamSrv_Start:SamLookupDomInSamSrv { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Lookup Domain In SAM Server") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamLookupDomInSamSrv_End:SamLookupDomInSamSrv { }; [Dynamic, Description("SAM Enumerate Domains In SAM Server") : amended, Guid("{7c65ceb0-75ba-46b9-884e-67e038c5b003}"), DisplayName("SamEnumDomInSamSrv"), locale("MS\\0x409") ] class SamEnumDomInSamSrv:MSSAMTrace { }; [Dynamic, Description("SAM Enumerate Domains In SAM Server") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamEnumDomInSamSrv_Start:SamEnumDomInSamSrv { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Enumerate Domains In SAM Server") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamEnumDomInSamSrv_End:SamEnumDomInSamSrv { }; [Dynamic, Description("SAM Open Domain") : amended, Guid("{6e1f2449-f1f3-4634-b51f-46e2c6625892}"), DisplayName("SamOpenDomain"), locale("MS\\0x409") ] class SamOpenDomain:MSSAMTrace { }; [Dynamic, Description("SAM Open Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamOpenDomain_Start:SamOpenDomain { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Open Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamOpenDomain_End:SamOpenDomain { }; [Dynamic, Description("SAM Query Information Domain") : amended, Guid("{89399c21-4aaf-408e-ba39-ab831a1298d5}"), DisplayName("SamQueryInfoDom"), locale("MS\\0x409") ] class SamQueryInfoDom:MSSAMTrace { }; [Dynamic, Description("SAM Query Information Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamQueryInfoDom_Start:SamQueryInfoDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Query Information Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamQueryInfoDom_End:SamQueryInfoDom { }; [Dynamic, Description("SAM Set Information Domain") : amended, Guid("{45309ef4-c59e-425e-b95b-19f1c5a3c55a}"), DisplayName("SamSetInfoDom"), locale("MS\\0x409") ] class SamSetInfoDom:MSSAMTrace { }; [Dynamic, Description("SAM Set Information Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetInfoDom_Start:SamSetInfoDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Information Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetInfoDom_End:SamSetInfoDom { }; [Dynamic, Description("SAM Enumerate Groups In Domain ") : amended, Guid("{5d11e02f-0c36-4180-ad07-89062c9df9ec}"), DisplayName("SamEnumGrpsInDom"), locale("MS\\0x409") ] class SamEnumGrpsInDom:MSSAMTrace { }; [Dynamic, Description("SAM Enumerate Groups In Domain ") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamEnumGrpsInDom_Start:SamEnumGrpsInDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Enumerate Groups In Domain ") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamEnumGrpsInDom_End:SamEnumGrpsInDom { }; [Dynamic, Description("SAM Enumerate Users In Domain") : amended, Guid("{07ffaa1d-34f6-49cd-b541-2f0d7dff15c4}"), DisplayName("SamEnumUsersInDom"), locale("MS\\0x409") ] class SamEnumUsersInDom:MSSAMTrace { }; [Dynamic, Description("SAM Enumerate Users In Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamEnumUsersInDom_Start:SamEnumUsersInDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Enumerate Users In Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamEnumUsersInDom_End:SamEnumUsersInDom { }; [Dynamic, Description("SAM Create Alias In Domain") : amended, Guid("{5e612efd-c05e-4f76-bced-f5607aa3d46e}"), DisplayName("SamCreateAliasInDom"), locale("MS\\0x409") ] class SamCreateAliasInDom:MSSAMTrace { }; [Dynamic, Description("SAM Create Alias In Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamCreateAliasInDom_Start:SamCreateAliasInDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Create Alias In Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamCreateAliasInDom_End:SamCreateAliasInDom { }; [Dynamic, Description("SAM Enumerate Aliases In Domain") : amended, Guid("{f1fea491-bfa6-436c-a178-a70d03b4fb1a}"), DisplayName("SamEnumAliasesInDom"), locale("MS\\0x409") ] class SamEnumAliasesInDom:MSSAMTrace { }; [Dynamic, Description("SAM Enumerate Aliases In Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamEnumAliasesInDom_Start:SamEnumAliasesInDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Enumerate Aliases In Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamEnumAliasesInDom_End:SamEnumAliasesInDom { }; [Dynamic, Description("SAM Get Alias Membership") : amended, Guid("{1cf5fd19-1ac1-4324-84f7-970a634a91ee}"), DisplayName("SamGetAliasMem"), locale("MS\\0x409") ] class SamGetAliasMem:MSSAMTrace { }; [Dynamic, Description("SAM Get Alias Membership") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetAliasMem_Start:SamGetAliasMem { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Alias Membership") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetAliasMem_End:SamGetAliasMem { }; [Dynamic, Description("SAM Open Group") : amended, Guid("{b41d7bdf-4249-4651-ac0f-1879be0d5c0c}"), DisplayName("SamOpenGrp"), locale("MS\\0x409") ] class SamOpenGrp:MSSAMTrace { }; [Dynamic, Description("SAM Open Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamOpenGrp_Start:SamOpenGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Open Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamOpenGrp_End:SamOpenGrp { }; [Dynamic, Description("SAM Query Information Group") : amended, Guid("{632fcc78-6057-48f9-8d5f-4bb0f73d3cd1}"), DisplayName("SamQueryInfoGrp"), locale("MS\\0x409") ] class SamQueryInfoGrp:MSSAMTrace { }; [Dynamic, Description("SAM Query Information Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamQueryInfoGrp_Start:SamQueryInfoGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Query Information Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamQueryInfoGrp_End:SamQueryInfoGrp { }; [Dynamic, Description("SAM Set Information Group") : amended, Guid("{26106246-4473-4295-841b-4a51c6afc3db}"), DisplayName("SamSetInfoGrp"), locale("MS\\0x409") ] class SamSetInfoGrp:MSSAMTrace { }; [Dynamic, Description("SAM Set Information Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetInfoGrp_Start:SamSetInfoGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Information Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetInfoGrp_End:SamSetInfoGrp { }; [Dynamic, Description("SAM Delete Group") : amended, Guid("{5f7c4ba5-d6a4-4625-900e-48fa7811e06a}"), DisplayName("SamDeleteGrp"), locale("MS\\0x409") ] class SamDeleteGrp:MSSAMTrace { }; [Dynamic, Description("SAM Delete Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamDeleteGrp_Start:SamDeleteGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Delete Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamDeleteGrp_End:SamDeleteGrp { }; [Dynamic, Description("SAM Get Members In Group") : amended, Guid("{5954bc51-c5ec-4aaa-831c-6f2c1b2515b6}"), DisplayName("SamGetMemInGrp"), locale("MS\\0x409") ] class SamGetMemInGrp:MSSAMTrace { }; [Dynamic, Description("SAM Get Members In Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetMemInGrp_Start:SamGetMemInGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Members In Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetMemInGrp_End:SamGetMemInGrp { }; [Dynamic, Description("SAM Set Member Attributes Of Group") : amended, Guid("{0254ba6d-7ff0-4bfe-a3f9-8fd8da667641}"), DisplayName("SamSetMemAttrsOfGrp"), locale("MS\\0x409") ] class SamSetMemAttrsOfGrp:MSSAMTrace { }; [Dynamic, Description("SAM Set Member Attributes Of Group") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetMemAttrsOfGrp_Start:SamSetMemAttrsOfGrp { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Member Attributes Of Group") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetMemAttrsOfGrp_End:SamSetMemAttrsOfGrp { }; [Dynamic, Description("SAM Open Alias") : amended, Guid("{ba41c883-592f-4ab9-b2a9-c6263b011fe7}"), DisplayName("SamOpenAlias"), locale("MS\\0x409") ] class SamOpenAlias:MSSAMTrace { }; [Dynamic, Description("SAM Open Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamOpenAlias_Start:SamOpenAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Open Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamOpenAlias_End:SamOpenAlias { }; [Dynamic, Description("SAM Query Information Alias") : amended, Guid("{419f025a-bf06-4673-af66-d230bec2af02}"), DisplayName("SamQueryInfoAlias"), locale("MS\\0x409") ] class SamQueryInfoAlias:MSSAMTrace { }; [Dynamic, Description("SAM Query Information Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamQueryInfoAlias_Start:SamQueryInfoAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Query Information Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamQueryInfoAlias_End:SamQueryInfoAlias { }; [Dynamic, Description("SAM Set Information Alias") : amended, Guid("{e712d39d-a3a6-4224-a1bd-4717b24e4e8c}"), DisplayName("SamSetInfoAlias"), locale("MS\\0x409") ] class SamSetInfoAlias:MSSAMTrace { }; [Dynamic, Description("SAM Set Information Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetInfoAlias_Start:SamSetInfoAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Information Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetInfoAlias_End:SamSetInfoAlias { }; [Dynamic, Description("SAM Delete Alias") : amended, Guid("{fbfe2540-452b-41bb-9219-dfb6fd1a129b}"), DisplayName("SamDeleteAlias"), locale("MS\\0x409") ] class SamDeleteAlias:MSSAMTrace { }; [Dynamic, Description("SAM Delete Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamDeleteAlias_Start:SamDeleteAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Delete Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamDeleteAlias_End:SamDeleteAlias { }; [Dynamic, Description("SAM Add Member To Alias") : amended, Guid("{3a2e63d1-5dc4-4168-85ea-3e331f88ce83}"), DisplayName("SamAddMemToAlias"), locale("MS\\0x409") ] class SamAddMemToAlias:MSSAMTrace { }; [Dynamic, Description("SAM Add Member To Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamAddMemToAlias_Start:SamAddMemToAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Add Member To Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamAddMemToAlias_End:SamAddMemToAlias { }; [Dynamic, Description("SAM Remove Member From Alias") : amended, Guid("{6ba1639c-afc4-454e-b3e0-5e8f7fc39af9}"), DisplayName("SamRemoveMemFromAlias"), locale("MS\\0x409") ] class SamRemoveMemFromAlias:MSSAMTrace { }; [Dynamic, Description("SAM Remove Member From Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamRemoveMemFromAlias_Start:SamRemoveMemFromAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Remove Member From Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamRemoveMemFromAlias_End:SamRemoveMemFromAlias { }; [Dynamic, Description("SAM Get Members In Alias") : amended, Guid("{5cec3d52-6eeb-474d-b468-58362888f1b0}"), DisplayName("SamGetMemInAlias"), locale("MS\\0x409") ] class SamGetMemInAlias:MSSAMTrace { }; [Dynamic, Description("SAM Get Members In Alias") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetMemInAlias_Start:SamGetMemInAlias { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Members In Alias") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetMemInAlias_End:SamGetMemInAlias { }; [Dynamic, Description("SAM Open User") : amended, Guid("{b8d2bc4a-1525-4386-bb1c-6bb2e24eb001}"), DisplayName("SamOpenUser"), locale("MS\\0x409") ] class SamOpenUser:MSSAMTrace { }; [Dynamic, Description("SAM Open User") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamOpenUser_Start:SamOpenUser { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Open User") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamOpenUser_End:SamOpenUser { }; [Dynamic, Description("SAM Delete User") : amended, Guid("{c2a0e094-a178-4372-b4fe-a33e48c3585c}"), DisplayName("SamDeleteUser"), locale("MS\\0x409") ] class SamDeleteUser:MSSAMTrace { }; [Dynamic, Description("SAM Delete User") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamDeleteUser_Start:SamDeleteUser { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Delete User") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamDeleteUser_End:SamDeleteUser { }; [Dynamic, Description("SAM Query Information User") : amended, Guid("{e1cb227a-6d55-4282-a5f7-6fa4a5922c0b}"), DisplayName("SamQueryInfoUser"), locale("MS\\0x409") ] class SamQueryInfoUser:MSSAMTrace { }; [Dynamic, Description("SAM Query Information User") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamQueryInfoUser_Start:SamQueryInfoUser { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Query Information User") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamQueryInfoUser_End:SamQueryInfoUser { }; [Dynamic, Description("SAM Set Information User") : amended, Guid("{bc80e27f-6b74-4da9-abfc-2e4e82b81000}"), DisplayName("SamSetInfoUser"), locale("MS\\0x409") ] class SamSetInfoUser:MSSAMTrace { }; [Dynamic, Description("SAM Set Information User") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetInfoUser_Start:SamSetInfoUser { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Information User") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetInfoUser_End:SamSetInfoUser { }; [Dynamic, Description("SAM Change Password Computer") : amended, Guid("{19b30cde-3e41-4cff-83c8-3df2779f840c}"), DisplayName("SamChangePwdComputer"), locale("MS\\0x409") ] class SamChangePwdComputer:MSSAMTrace { }; [Dynamic, Description("SAM Change Password Computer") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamChangePwdComputer_Start:SamChangePwdComputer { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Change Password Computer") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamChangePwdComputer_End:SamChangePwdComputer { }; [Dynamic, Description("SAM Get Groups For User") : amended, Guid("{0e3913c5-9760-4ced-b133-004a64e8d53c}"), DisplayName("SamGetGrpsForUser"), locale("MS\\0x409") ] class SamGetGrpsForUser:MSSAMTrace { }; [Dynamic, Description("SAM Get Groups For User") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetGrpsForUser_Start:SamGetGrpsForUser { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Groups For User") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetGrpsForUser_End:SamGetGrpsForUser { }; [Dynamic, Description("SAM Query Display Information") : amended, Guid("{eb225178-f5f0-42b7-895b-db89276f647a}"), DisplayName("SamQueryDisplayInfo"), locale("MS\\0x409") ] class SamQueryDisplayInfo:MSSAMTrace { }; [Dynamic, Description("SAM Query Display Information") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamQueryDisplayInfo_Start:SamQueryDisplayInfo { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Query Display Information") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamQueryDisplayInfo_End:SamQueryDisplayInfo { }; [Dynamic, Description("SAM Get Display Enumeration Index") : amended, Guid("{aceb7864-9a14-4c73-8ed0-94ec53f6651c}"), DisplayName("SamGetDisplayEnumIdx"), locale("MS\\0x409") ] class SamGetDisplayEnumIdx:MSSAMTrace { }; [Dynamic, Description("SAM Get Display Enumeration Index") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetDisplayEnumIdx_Start:SamGetDisplayEnumIdx { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Display Enumeration Index") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetDisplayEnumIdx_End:SamGetDisplayEnumIdx { }; [Dynamic, Description("SAM Get User Domain Password Information") : amended, Guid("{4ff7a7db-43ca-470a-8b64-3003e2d22042}"), DisplayName("SamGetUserDomPwdInfo"), locale("MS\\0x409") ] class SamGetUserDomPwdInfo:MSSAMTrace { }; [Dynamic, Description("SAM Get User Domain Password Information") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetUserDomPwdInfo_Start:SamGetUserDomPwdInfo { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get User Domain Password Information") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetUserDomPwdInfo_End:SamGetUserDomPwdInfo { }; [Dynamic, Description("SAM Remove Member From Foreign Domain") : amended, Guid("{8919f267-a053-4669-aa69-2da0d4a20d92}"), DisplayName("SamRemoveMemFromForeignDom"), locale("MS\\0x409") ] class SamRemoveMemFromForeignDom:MSSAMTrace { }; [Dynamic, Description("SAM Remove Member From Foreign Domain") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamRemoveMemFromForeignDom_Start:SamRemoveMemFromForeignDom { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Remove Member From Foreign Domain") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamRemoveMemFromForeignDom_End:SamRemoveMemFromForeignDom { }; [Dynamic, Description("SAM Get Domain Password Information") : amended, Guid("{ff0c6ce2-9528-4a91-b9c7-bcf834b6f79a}"), DisplayName("SamGetDomPwdInfo"), locale("MS\\0x409") ] class SamGetDomPwdInfo:MSSAMTrace { }; [Dynamic, Description("SAM Get Domain Password Information") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetDomPwdInfo_Start:SamGetDomPwdInfo { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Domain Password Information") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetDomPwdInfo_End:SamGetDomPwdInfo { }; [Dynamic, Description("SAM Set Boot Key Information") : amended, Guid("{2e991575-c2ed-42a7-97ff-a0d6571f1862}"), DisplayName("SamSetBootKeyInfo"), locale("MS\\0x409") ] class SamSetBootKeyInfo:MSSAMTrace { }; [Dynamic, Description("SAM Set Boot Key Information") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamSetBootKeyInfo_Start:SamSetBootKeyInfo { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Set Boot Key Information") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamSetBootKeyInfo_End:SamSetBootKeyInfo { }; [Dynamic, Description("SAM Get Boot Key Information") : amended, Guid("{33be4128-d02e-4b6f-949e-ab77cc8164b1}"), DisplayName("SamGetBootKeyInfo"), locale("MS\\0x409") ] class SamGetBootKeyInfo:MSSAMTrace { }; [Dynamic, Description("SAM Get Boot Key Information") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamGetBootKeyInfo_Start:SamGetBootKeyInfo { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Get Boot Key Information") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamGetBootKeyInfo_End:SamGetBootKeyInfo { }; [Dynamic, Description("SAM Process Mapped Attributes") : amended, Guid("{96bd320f-1e51-4c06-86f3-ee64f0a2f0cf}"), DisplayName("SampProcessMappedAttributes"), locale("MS\\0x409") ] class SamProcessMappedAttributes:MSSAMTrace { }; [Dynamic, Description("SAM Process Mapped Attributes") : amended, EventType(1), EventTypeName("Start"), locale("MS\\0x409") ] class SamProcessMappedAttributes_Start:SamProcessMappedAttributes { [WmiDataId(1), Description("Signature") : amended, StringTermination("NullTerminated"), format("w"), read] string Sam; [WmiDataId(2), Description("SamTraceVersion") : amended, read] uint32 Version; [WmiDataId(3), Description("Client SID") : amended, StringTermination("NullTerminated"), format("w"), read] string Sid; [WmiDataId(4), Description("Client Network Address") : amended, StringTermination("NullTerminated"), format("w"), read] string Client; }; [Dynamic, Description("SAM Process Mapped Attributes") : amended, EventType(2), EventTypeName("End"), locale("MS\\0x409") ] class SamProcessMappedAttributes_End:SamProcessMappedAttributes { };
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de