????

Your IP : 18.189.189.4


Current Path : C:/Windows/SysWOW64/
Upload File :
Current File : C:/Windows/SysWOW64/msobjs.dll

MZ����@���	�!�L�!This program cannot be run in DOS mode.

$��<߱�R���R���R�U�����R�U�P���R�Rich��R�PEL(�,�!�PP


 �@ ��8.text�@@.rsrc�� �@@(�,
T88(�,$��8.rdata8x.rdata$zzzdbg �.rsrc$01� ��.rsrc$02 �b_}Fg�v�Ht�?O_6Q��K��J	x�(�,��(�@�X�p�����	�	�	���� <�0�MUI>�<HAA�CX�)�09�@@P[Tpr���d��?�		�2�	�	�6�	�	7�	�	x8�	�	�9�	�	�:�	�	@;/?@�L��{��ȆO��D�O��	��x��x�$$�����	���H�������,� 8 ��P X ��!!�00`�11P�2
2@�33��44��55��66$�77��88��99��998�99�� 9!9��0969��P9Y9��`9`9��@@�� @ @��B	B��PUndefined Access (no effect) Bit 7

,Unused message ID

DELETE

$READ_CONTROL

WRITE_DAC

 WRITE_OWNER

 SYNCHRONIZE

(ACCESS_SYS_SEC

 MAX_ALLOWED

HUnknown specific access (bit 0)

HUnknown specific access (bit 1)

HUnknown specific access (bit 2)

HUnknown specific access (bit 3)

HUnknown specific access (bit 4)

HUnknown specific access (bit 5)

HUnknown specific access (bit 6)

HUnknown specific access (bit 7)

HUnknown specific access (bit 8)

HUnknown specific access (bit 9)

LUnknown specific access (bit 10)

LUnknown specific access (bit 11)

LUnknown specific access (bit 12)

LUnknown specific access (bit 13)

LUnknown specific access (bit 14)

LUnknown specific access (bit 15)

Not used

HAssign Primary Token Privilege

4Lock Memory Privilege

HIncrease Memory Quota Privilege

@Unsolicited Input Privilege

HTrusted Computer Base Privilege

0Security Privilege

<Take Ownership Privilege

DLoad/Unload Driver Privilege

<Profile System Privilege

<Set System Time Privilege

LProfile Single Process Privilege

LIncrement Base Priority Privilege

<Create Pagefile Privilege

LCreate Permanent Object Privilege

,Backup Privilege

DRestore From Backup Privilege

<Shutdown System Privilege

(Debug Privilege

PView or Change Audit Log Privilege

TChange Hardware Environment Privilege

XChange Notify (and Traverse) Privilege

PRemotely Shut System Down Privilege

P<value changed, but not displayed>

(<value not set>

<never>

Enabled

Disabled

All

None

TAudit Policy query/set API Operation

�<Value change auditing for this registry type is not supported>

 Granted by

Denied by

LDenied by Integrity Policy check

4Granted by Ownership

 Not granted

4Granted by NULL DACL

4Denied by Empty DACL

PGranted by NULL Security Descriptor

4Unknown or unchecked

@Not granted due to missing

HGranted by ACE on parent folder

HDenied by ACE on parent folder

HGranted by Central Access Rule 

PNOT Granted by Central Access Rule 

hGranted by parent folder's Central Access Rule 

pNOT Granted by parent folder's Central Access Rule 

$Unknown Type

String

8Unsigned 64-bit Integer

(64-bit Integer

FQBN

Blob

Sid

Boolean

True

False

Invalid

@an ACE too long to display

\a Security Descriptor too long to display

DNot granted to AppContainers

...

(Identification

$Impersonation

 Delegation

LDenied by Process Trust Label ACE

Yes

No

System

$Not Available

Default

,DisallowMmConfig

Off

Auto

@Denied by Access Filter Ace

REG_NONE

REG_SZ

$REG_EXPAND_SZ

 REG_BINARY

REG_DWORD

4REG_DWORD_BIG_ENDIAN

REG_LINK

�REG_MULTI_SZ (New lines are replaced with *. A * is replaced with **)

,REG_RESOURCE_LIST

DREG_FULL_RESOURCE_DESCRIPTOR

HREG_RESOURCE_REQUIREMENTS_LIST

REG_QWORD

@New registry value created

LExisting registry value modified

8Registry value deleted

Sunday

Monday

Tuesday

Wednesday

Thursday

Friday

Saturday

DTokenElevationTypeDefault (1)

@TokenElevationTypeFull (2)

DTokenElevationTypeLimited (3)

(Account Enabled

T'Home Directory Required' - Disabled

P'Password Not Required' - Disabled

P'Temp Duplicate Account' - Disabled

@'Normal Account' - Disabled

H'MNS Logon Account' - Disabled

X'Interdomain Trust Account' - Disabled

X'Workstation Trust Account' - Disabled

L'Server Trust Account' - Disabled

P'Don't Expire Password' - Disabled

,Account Unlocked

d'Encrypted Text Password Allowed' - Disabled

H'Smartcard Required' - Disabled

P'Trusted For Delegation' - Disabled

@'Not Delegated' - Disabled

D'Use DES Key Only' - Disabled

P'Don't Require Preauth' - Disabled

D'Password Expired' - Disabled

p'Trusted To Authenticate For Delegation' - Disabled

h'Exclude Authorization Information' - Disabled

l'Undefined UserAccountControl Bit 20' - Disabled

�'Protect Kerberos Service Tickets with AES Keys' - Disabled

l'Undefined UserAccountControl Bit 22' - Disabled

l'Undefined UserAccountControl Bit 23' - Disabled

l'Undefined UserAccountControl Bit 24' - Disabled

l'Undefined UserAccountControl Bit 25' - Disabled

l'Undefined UserAccountControl Bit 26' - Disabled

l'Undefined UserAccountControl Bit 27' - Disabled

l'Undefined UserAccountControl Bit 28' - Disabled

l'Undefined UserAccountControl Bit 29' - Disabled

l'Undefined UserAccountControl Bit 30' - Disabled

l'Undefined UserAccountControl Bit 31' - Disabled

,Account Disabled

P'Home Directory Required' - Enabled

L'Password Not Required' - Enabled

P'Temp Duplicate Account' - Enabled

@'Normal Account' - Enabled

D'MNS Logon Account' - Enabled

T'Interdomain Trust Account' - Enabled

T'Workstation Trust Account' - Enabled

L'Server Trust Account' - Enabled

L'Don't Expire Password' - Enabled

(Account Locked

`'Encrypted Text Password Allowed' - Enabled

H'Smartcard Required' - Enabled

P'Trusted For Delegation' - Enabled

<'Not Delegated' - Enabled

D'Use DES Key Only' - Enabled

L'Don't Require Preauth' - Enabled

D'Password Expired' - Enabled

p'Trusted To Authenticate For Delegation' - Enabled

d'Exclude Authorization Information' - Enabled

h'Undefined UserAccountControl Bit 20' - Enabled

�'Protect Kerberos Service Tickets with AES Keys' - Enabled

h'Undefined UserAccountControl Bit 22' - Enabled

h'Undefined UserAccountControl Bit 23' - Enabled

h'Undefined UserAccountControl Bit 24' - Enabled

h'Undefined UserAccountControl Bit 25' - Enabled

h'Undefined UserAccountControl Bit 26' - Enabled

h'Undefined UserAccountControl Bit 27' - Enabled

h'Undefined UserAccountControl Bit 28' - Enabled

h'Undefined UserAccountControl Bit 29' - Enabled

h'Undefined UserAccountControl Bit 30' - Enabled

h'Undefined UserAccountControl Bit 31' - Enabled

HAn Error occured during Logon.

XThe specified user account has expired.

TThe NetLogon component is not active.

0Account locked out.

�The user has not been granted the requested logon type at this machine.

dThe specified account's password has expired.

@Account currently disabled.

\Account logon time restriction violation.

`User not allowed to logon at this computer.

PUnknown user name or bad password.

<Domain sid inconsistent.

dSmartcard logon is required and was not used.

(Not Available.

LRandom number generator failure.

|Random number generation failed FIPS-140 pre-hash check.

@Failed to zero secret data.

XKey failed pair wise consistency check.

lFailed to unprotect persistent cryptographic key.

<Key export checks failed.

LValidation of public key failed.

HSignature verification failed.

(Open key file.

,Delete key file.

DRead persisted key from file.

DWrite persisted key to file.

XExport of persistent cryptographic key.

XImport of persistent cryptographic key.

Open Key.

 Create Key.

 Delete Key.

Encrypt.

Decrypt.

 Sign hash.

,Secret agreement.

(Domain settings

(Local settings

$Add provider.

,Remove provider.

$Add context.

(Remove context.

$Add function.

,Remove function.

8Add function provider.

<Remove function provider.

8Add function property.

<Remove function property.

$Machine key.

User key.

(Key Derivation.

(Claim Creation.

0Claim Verification.

0Device Access Bit 0

0Device Access Bit 1

0Device Access Bit 2

0Device Access Bit 3

0Device Access Bit 4

0Device Access Bit 5

0Device Access Bit 6

0Device Access Bit 7

0Device Access Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(Query directory

Traverse

@Create object in directory

4Create sub-directory

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

,Query event state

0Modify event state

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

@ReadData (or ListDirectory)

8WriteData (or AddFile)

tAppendData (or AddSubdirectory or CreatePipeInstance)

ReadEA

WriteEA

,Execute/Traverse

 DeleteChild

(ReadAttributes

(WriteAttributes

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(Query key value

$Set key value

(Create sub-key

0Enumerate sub-keys

DNotify about changes to keys

 Create Link

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

pEnable 64(or 32) bit application to open 64 bit key

pEnable 64(or 32) bit application to open 32 bit key

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

0Query mutant state

PUndefined Access (no effect) Bit 1

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

8Communicate using port

PUndefined Access (no effect) Bit 1

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

<Force process termination

DCreate new thread in process

8Set process session ID

LPerform virtual memory operation

<Read from process memory

8Write to process memory

XDuplicate handle into or out of process

HCreate a subprocess of process

0Set process quotas

8Set process information

<Query process information

DSet process termination port

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(Control profile

PUndefined Access (no effect) Bit 1

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

0Query section state

4Map section for write

4Map section for read

8Map section for execute

 Extend size

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

4Query semaphore state

8Modify semaphore state

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

,Use symbolic link

PUndefined Access (no effect) Bit 1

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

<Force thread termination

<Suspend or resume thread

8Send an alert to thread

0Get thread context

0Set thread context

8Set thread information

<Query thread information

DAssign a token to the thread

pCause thread to directly impersonate another thread

LDirectly impersonate this thread

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

,Query timer state

0Modify timer state

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(AssignAsPrimary

Duplicate

 Impersonate

Query

 QuerySource

,AdjustPrivileges

$AdjustGroups

,AdjustDefaultDacl

(AdjustSessionID

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

HCreate instance of object type

PUndefined Access (no effect) Bit 1

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

 Query State

$Modify State

4Channel read message

4Channel write message

<Channel query information

8Channel set information

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(Assign process

(Set Attributes

,Query Attributes

$Terminate Job

8Set Security Attributes

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(ConnectToServer

(ShutdownServer

,InitializeServer

$CreateDomain

,EnumerateDomains

$LookupDomain

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

8ReadPasswordParameters

8WritePasswordParameters

0ReadOtherParameters

4WriteOtherParameters

 CreateUser

,CreateGlobalGroup

,CreateLocalGroup

8GetLocalGroupMembership

$ListAccounts

LookupIDs

,AdministerServer

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(ReadInformation

$WriteAccount

AddMember

$RemoveMember

 ListMembers

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

AddMember

$RemoveMember

 ListMembers

(ReadInformation

$WriteAccount

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

8ReadGeneralInformation

(ReadPreferences

,WritePreferences

ReadLogon

 ReadAccount

$WriteAccount

hChangePassword (with knowledge of old password)

hSetPassword (without knowledge of old password)

 ListGroups

0ReadGroupMembership

4ChangeGroupMembership

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

TView non-sensitive policy information

HView system audit requirements

LGet sensitive policy information

LModify domain trust relationships

xCreate special accounts (for assignment of user rights)

8Create a secret object

0Create a privilege

<Set default quota limits

LChange system audit requirements

HAdminister audit log attributes

0Enable/Disable LSA

,Lookup Names/SIDs

0Change secret value

0Query secret value

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

DQuery trusted domain name/SID

hRetrieve the controllers in the trusted domain

dChange the controllers in the trusted domain

|Query the Posix ID offset assigned to the trusted domain

|Change the Posix ID offset assigned to the trusted domain

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

<Query account information

TChange privileges assigned to account

LChange quotas assigned to account

dChange logon capabilities assigned to account

�Change the Posix ID offset assigned to the accounted domain

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

(KeyedEvent Wait

(KeyedEvent Wake

PUndefined Access (no effect) Bit 2

PUndefined Access (no effect) Bit 3

PUndefined Access (no effect) Bit 4

PUndefined Access (no effect) Bit 5

PUndefined Access (no effect) Bit 6

PUndefined Access (no effect) Bit 7

PUndefined Access (no effect) Bit 8

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

0Enumerate desktops

(Read attributes

,Access Clipboard

(Create desktop

,Write attributes

0Access global atoms

$Exit windows

0Unused Access Flag

`Include this windowstation in enumerations

 Read screen

$Read Objects

$Create window

 Create menu

$Hook control

,Journal (record)

0Journal (playback)

TInclude this desktop in enumerations

$Write objects

8Switch to this desktop

8Administer print server

0Enumerate printers

$Full Control

Print

0Administer Document

DConnect to service controller

4Create a new service

0Enumerate services

`Lock service database for exclusive access

LQuery service database lock state

dSet last-known-good state of service database

XQuery service configuration information

TSet service configuration information

8Query status of service

LEnumerate dependencies of service

,Start the service

,Stop the service

DPause or continue the service

HQuery information from service

XIssue service-specific control commands

(DDE Share Read

(DDE Share Write

<DDE Share Initiate Static

8DDE Share Initiate Link

,DDE Share Request

,DDE Share Advise

(DDE Share Poke

,DDE Share Execute

0DDE Share Add Items

4DDE Share List Items

$Create Child

$Delete Child

$List Contents

 Write Self

$Read Property

(Write Property

 Delete Tree

 List Object

(Control Access

PUndefined Access (no effect) Bit 9

PUndefined Access (no effect) Bit 10

PUndefined Access (no effect) Bit 11

PUndefined Access (no effect) Bit 12

PUndefined Access (no effect) Bit 13

PUndefined Access (no effect) Bit 14

PUndefined Access (no effect) Bit 15

8Audit Set System Policy

<Audit Query System Policy

<Audit Set Per User Policy

@Audit Query Per User Policy

4Audit Enumerate Users

,Audit Set Options

0Audit Query Options

0Port sharing (read)

4Port sharing (write)

0Default credentials

0Credentials manager

,Fresh credentials

(Read Credential

4Enumerate Credentials

8Read Domain Credentials

4Find Best Credential

4Read By Token Handle

Kerberos

$Preshared key

8Unknown authentication

DES

3DES

MD5

SHA1

(Local computer

(Remote computer

No state

8Sent first (SA) payload

<Sent second (KE) payload

8Sent third (ID) payload

Initiator

Responder

No state

8Sent first (SA) payload

0Sent final payload

Complete

Unknown

Transport

Tunnel

XIKE/AuthIP DoS prevention mode started

XIKE/AuthIP DoS prevention mode stopped

Enabled

 Not enabled

No state

PSent first (EM attributes) payload

@Sent second (SSPI) payload

<Sent third (hash) payload

IKEv1

AuthIP

Anonymous

NTLM V2

CGA

 Certificate

SSL

None

 DH group 1

 DH group 2

 DH group 14

,DH group ECP 256

,DH group ECP 384

AES-128

AES-192

AES-256

8Certificate ECDSA P256

8Certificate ECDSA P384

(SSL ECDSA P256

(SSL ECDSA P384

SHA 256

SHA 384

IKEv2

,EAP payload sent

@Authentication payload sent

EAP

 DH group 24

System

$Logon/Logoff

$Object Access

$Privilege Use

,Detailed Tracking

$Policy Change

0Account Management

DS Access

$Account Logon

(Success removed

$Success Added

(Failure removed

$Failure added

8Success include removed

4Success include added

8Success exclude removed

4Success exclude added

8Failure include removed

4Failure include added

8Failure exclude removed

4Failure exclude added

4Security State Change

<Security System Extension

,System Integrity

$IPsec Driver

0Other System Events

Logon

Logoff

(Account Lockout

(IPsec Main Mode

$Special Logon

,IPsec Quick Mode

0IPsec Extended Mode

<Other Logon/Logoff Events

4Network Policy Server

4User / Device Claims

,Group Membership

$Access Rights

 File System

Registry

$Kernel Object

SAM

@Other Object Access Events

8Certification Services

4Application Generated

0Handle Manipulation

 File Share

HFiltering Platform Packet Drop

DFiltering Platform Connection

0Detailed File Share

,Removable Storage

8Central Policy Staging

8Sensitive Privilege Use

@Non Sensitive Privilege Use

@Other Privilege Use Events

,Process Creation

0Process Termination

(DPAPI Activity

 RPC Events

4Plug and Play Events

@Token Right Adjusted Events

0Audit Policy Change

DAuthentication Policy Change

@Authorization Policy Change

HMPSSVC Rule-Level Policy Change

LFiltering Platform Policy Change

@Other Policy Change Events

8User Account Management

@Computer Account Management

<Security Group Management

DDistribution Group Management

DApplication Group Management

HOther Account Management Events

<Directory Service Access

<Directory Service Changes

DDirectory Service Replication

XDetailed Directory Service Replication

4Credential Validation

PKerberos Service Ticket Operations

@Other Account Logon Events

HKerberos Authentication Service

Inbound

Outbound

Forward

$Bidirectional

IP Packet

Transport

Forward

Stream

$Datagram Data

 ICMP Error

MAC 802.3

 MAC Native

vSwitch

0Resource Assignment

Listen

(Receive/Accept

Connect

,Flow Established

,Resource Release

,Endpoint Closure

,Connect Redirect

$Bind Redirect

$Stream Packet

(Accept Redirect

,ICMP Echo-Request

(vSwitch Ingress

(vSwitch Egress

Unknown

Public

Private

Domain

<Binary>

[NULL]

 Value Added

$Value Deleted

LActive Directory Domain Services

hActive Directory Lightweight Directory Services

Yes

No

LValue Added With Expiration Time

PValue Deleted With Expiration Time

XValue Auto Deleted With Expiration Time

Add

Delete

Boot-time

 Persistent

(Not persistent

Block

Permit

Callout

MD5

SHA-1

SHA-256

 AES-GCM 128

 AES-GCM 192

 AES-GCM 256

DES

3DES

AES-128

AES-192

AES-256

Transport

Tunnel

Responder

Initiator

$AES-GMAC 128

$AES-GMAC 192

$AES-GMAC 256

4AuthNoEncap Transport

0Enable WMI Account

(Execute Method

 Full Write

$Partial Write

(Provider Write

$Remote Access

Subscribe

Publish

 AES-GSM-128

 AES-GSM-256

�4VS_VERSION_INFO��
{
|O
{
|O?�StringFileInfo�040904B0LCompanyNameMicrosoft Corporation\FileDescriptionSystem object audit namesn'FileVersion10.0.20348.3451 (WinBuild.160101.0800)6InternalNamemsobjs.dll�.LegalCopyright� Microsoft Corporation. All rights reserved.>OriginalFilenamemsobjs.dllj%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.20348.3451DVarFileInfo$Translation	������f���5S^O���<"�d����`7)Rx��������MUIMUIen-US