1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
/*
IDL constants for windows event codes.
*/
[
pointer_default(unique)
]
interface windows_events
{
typedef [v1_enum,public] enum {
EVT_ID_NONE = 0,
EVT_ID_SUCCESSFUL_LOGON = 4624,
EVT_ID_UNSUCCESSFUL_LOGON = 4625,
EVT_ID_PASSWORD_CHANGE = 4723,
EVT_ID_PASSWORD_RESET = 4724,
EVT_ID_USER_ADDED_TO_GLOBAL_SEC_GROUP = 4728,
EVT_ID_USER_REMOVED_FROM_GLOBAL_SEC_GROUP = 4729,
EVT_ID_USER_ADDED_TO_LOCAL_SEC_GROUP = 4732,
EVT_ID_USER_REMOVED_FROM_LOCAL_SEC_GROUP = 4733,
EVT_ID_USER_ADDED_TO_LOCAL_GROUP = 4746,
EVT_ID_USER_REMOVED_FROM_LOCAL_GROUP = 4747,
EVT_ID_USER_ADDED_TO_GLOBAL_GROUP = 4751,
EVT_ID_USER_REMOVED_FROM_GLOBAL_GROUP = 4752,
EVT_ID_USER_ADDED_TO_UNIVERSAL_SEC_GROUP = 4756,
EVT_ID_USER_REMOVED_FROM_UNIVERSAL_SEC_GROUP = 4757,
EVT_ID_USER_ADDED_TO_UNIVERSAL_GROUP = 4761,
EVT_ID_USER_REMOVED_FROM_UNIVERSAL_GROUP = 4762
} event_id_type;
/* See https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/authentication-policies-and-authentication-policy-silos#BKMK_ErrorandEvents */
typedef [v1_enum,public] enum {
AUTH_EVT_ID_NONE = 0,
AUTH_EVT_ID_NTLM_DEVICE_RESTRICTION = 101,
AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION = 105,
AUTH_EVT_ID_KERBEROS_DEVICE_RESTRICTION_AUDIT = 305,
AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION = 106,
AUTH_EVT_ID_KERBEROS_SERVER_RESTRICTION_AUDIT = 306
} auth_event_id_type;
typedef [v1_enum,public] enum {
EVT_LOGON_INTERACTIVE = 2,
EVT_LOGON_NETWORK = 3,
EVT_LOGON_BATCH = 4,
EVT_LOGON_SERVICE = 5,
EVT_LOGON_UNLOCK = 7,
EVT_LOGON_NETWORK_CLEAR_TEXT = 8,
EVT_LOGON_NEW_CREDENTIALS = 9,
EVT_LOGON_REMOTE_INTERACTIVE = 10,
EVT_LOGON_CACHED_INTERACTIVE = 11
} event_logon_type;
}
|