Microsoft-Windows-IIS-IisMetabaseAudit

13 events across 1 channel

Event ID	Title	Channel
4500	Metabase Add Key.	Operational
4501	Metabase Delete Key.	Operational
4502	Metabase Delete Child Keys.	Operational
4503	Metabase Copy Key.	Operational
4504	Metabase Rename Key.	Operational
4505	Metabase Set Data.	Operational
4506	Metabase Delete Data.	Operational
4507	Metabase Delete All Data.	Operational
4508	Metabase Copy Data.	Operational
4509	Metabase Set Last Change Time.	Operational
4510	Metabase Restore.	Operational
4511	Metabase Delete Backup.	Operational
4512	Metabase Import.	Operational

Event ID 4500 — Metabase Add Key.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Add Key.

Message #

Metabase Add Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4501 — Metabase Delete Key.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Delete Key.

Message #

Metabase Delete Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4502 — Metabase Delete Child Keys.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Delete Child Keys.

Message #

Metabase Delete Child Keys.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4503 — Metabase Copy Key.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Copy Key.

Message #

Metabase Copy Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 Destination Path: %5
 Caller PID: %6
 Caller Image Path: %7
 Result: %8

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabaseSourcePath` UnicodeString	—
`MetabaseDestinationPath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4504 — Metabase Rename Key.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Rename Key.

Message #

Metabase Rename Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 New Key Name: %5
 Caller PID: %6
 Caller Image Path: %7
 Result: %8

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabaseSourcePath` UnicodeString	—
`NewKeyName` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4505 — Metabase Set Data.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Set Data.

Message #

Metabase Set Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Property ID: %5
 Property Name: %6
 Old Value: %7
 New Value: %8
 Caller PID: %9
 Caller Image Path: %10
 Result: %11

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`PropertyID` UnicodeString	—
`PropertyName` UnicodeString	—
`OldValue` UnicodeString	—
`NewValue` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4506 — Metabase Delete Data.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Delete Data.

Message #

Metabase Delete Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Property ID: %5
 Property Name: %6
 Old Value: %7
 Caller PID: %8
 Caller Image Path: %9
 Result: %10

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`PropertyID` UnicodeString	—
`PropertyName` UnicodeString	—
`OldValue` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4507 — Metabase Delete All Data.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Delete All Data.

Message #

Metabase Delete All Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4508 — Metabase Copy Data.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Copy Data.

Message #

Metabase Copy Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 Destination Path: %5
 Caller PID: %6
 Caller Image Path: %7
 Result: %8

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabaseSourcePath` UnicodeString	—
`MetabaseDestinationPath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4509 — Metabase Set Last Change Time.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Set Last Change Time.

Message #

Metabase Set Last Change Time.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabasePath` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4510 — Metabase Restore.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Restore.

Message #

Metabase Restore.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Name of Backup: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`BackupName` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4511 — Metabase Delete Backup.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Delete Backup.

Message #

Metabase Delete Backup.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Name of Backup: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`BackupName` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—

Event ID 4512 — Metabase Import.

Provider: Microsoft-Windows-IIS-IisMetabaseAudit
Channel: Operational

Description

Metabase Import.

Message #

Metabase Import.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 Destination Path: %5
 Filename: %6
 Caller PID: %7
 Caller Image Path: %8
 Result: %9

Fields #

Name	Description
`UserName` UnicodeString	—
`Domain` UnicodeString	—
`LogonID` UnicodeString	—
`MetabaseSourcePath` UnicodeString	—
`MetabaseDestinationPath` UnicodeString	—
`ImportFileName` UnicodeString	—
`CallerPID` UnicodeString	—
`CallerImagePath` UnicodeString	—
`Result` UnicodeString	—