IRP logs of using Word to open a file and save it.
Updated 2018/07/17
ProcMon log:
| Time of Day | Completion Time | Operation | Result | Path | Detail |
|---|---|---|---|---|---|
| Time of Day | Completion Time | Operation | Result | Path | Detail |
| 4:10:55.4601954 PM | 4:10:55.4611357 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:55.4665666 PM | 4:10:55.4667455 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:10:55.4688062 PM | 4:10:55.4689314 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:10:57.9269121 PM | 4:10:57.9269828 PM | CreateFile | SUCCESS | \\nurl\PIPE\wkssvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Superseded |
| 4:10:57.9847305 PM | 4:10:57.9857822 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.0512435 PM | 4:10:58.1113288 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.1135791 PM | 4:10:58.1147998 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Generic Read/Write, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.1157385 PM | 4:10:58.1162501 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened |
| READ OPERATIONS OCCUR HERE. | |||||
| 4:10:58.1770990 PM | 4:10:58.1776087 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.1833706 PM | 4:10:58.1854076 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2095356 PM | 4:10:58.2105971 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2121173 PM | 4:10:58.2126826 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2139757 PM | 4:10:58.2147045 PM | CreateFile | NOT SUPPORTED | \\nurl\MyServer\Test.txt:Zone.Identifier | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a |
| 4:10:58.2533720 PM | 4:10:58.2538417 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2555401 PM | 4:10:58.2561876 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2572369 PM | 4:10:58.2607944 PM | CreateFile | SUCCESS | \\nurl\MyServer\~$Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2618255 PM | 4:10:58.2623857 PM | CreateFile | SUCCESS | \\nurl\MyServer\~$Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:10:58.2632485 PM | 4:10:58.2638391 PM | CreateFile | SUCCESS | \\nurl\MyServer\~$Test.txt | Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.2629175 PM | 4:11:02.2634066 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.2644610 PM | 4:11:02.2647853 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.2795041 PM | 4:11:02.2845838 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.2853510 PM | 4:11:02.2854490 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:02.2886877 PM | 4:11:02.2887683 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:02.3187780 PM | 4:11:02.3193706 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.3188400 PM | 4:11:02.3197151 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.3216299 PM | 4:11:02.3223079 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.3216928 PM | 4:11:02.3230478 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.4181040 PM | 4:11:02.4186440 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:02.4194630 PM | 4:11:02.4195574 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:02.4215548 PM | 4:11:02.4216232 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:02.4568093 PM | 4:11:02.4573079 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| QUERY_INFORMATION happens here. | |||||
| 4:11:02.5110035 PM | 4:11:02.5114969 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| A lot of QUERY_INFORMATION here. | |||||
| 4:11:18.6925801 PM | 4:11:18.6929815 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:18.6934876 PM | 4:11:18.6935543 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:18.6954680 PM | 4:11:18.6955387 PM | CreateFile | NOT FOUND | \\nurl\PIPE\srvsvc | Desired Access: Generic Read/Write, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:22.2884554 PM | 4:11:22.2891294 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.2904635 PM | 4:11:22.2909522 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.2915251 PM | 4:11:22.2919308 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.2929674 PM | 4:11:22.2933763 PM | CreateFile | NAME NOT FOUND | \\nurl\MyServer\Backup of Test.wbk | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a |
| 4:11:22.2943794 PM | 4:11:22.2947808 PM | CreateFile | NAME NOT FOUND | \\nurl\MyServer\Backup of Test.wbk | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a |
| 4:11:22.3959232 PM | 4:11:22.3962610 PM | CreateFile | SUCCESS | \\nurl\MyServer\ | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.3972668 PM | 4:11:22.3984283 PM | CreateFile | NAME NOT FOUND | \\nurl\MyServer\FFB435A4.tmp | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a |
| 4:11:22.4003147 PM | 4:11:22.4019226 PM | CreateFile | SUCCESS | \\nurl\MyServer\FFB435A4.tmp | Desired Access: Generic Read/Write, Delete, Write DAC, Disposition: OverwriteIf, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: ANCI, ShareMode: None, AllocationSize: 1,265,519, OpenResult: Created |
| 4:11:22.4025370 PM | 4:11:22.4030237 PM | CreateFile | SUCCESS | \\nurl\MyServer\FFB435A4.tmp | Desired Access: Generic Read/Write, Delete, Write DAC, Disposition: OpenIf, Options: Sequential Access, Non-Directory File, Attributes: ANCI, ShareMode: None, AllocationSize: 1,265,519, OpenResult: Opened |
| WRITE happens here. | |||||
| 4:11:22.4107843 PM | 4:11:22.4114231 PM | CreateFile | NAME NOT FOUND | \\nurl\MyServer\68A1155.tmp | Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a |
| 4:11:22.4121895 PM | 4:11:22.4132352 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Read Control, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.4145433 PM | 4:11:22.4432670 PM | CreateFile | SUCCESS | \\nurl\MyServer\FFB435A4.tmp | Desired Access: Write DAC, Write Owner, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.4439710 PM | 4:11:22.4444878 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Generic Read, Write Data/Add File, Delete, Access System Security, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.4450278 PM | 4:11:22.4455343 PM | CreateFile | SUCCESS | \\nurl\MyServer\Test.txt | Desired Access: Generic Read, Write Data/Add File, Delete, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.4460348 PM | 4:11:22.4465531 PM | CreateFile | SUCCESS | \\nurl\MyServer\FFB435A4.tmp | Desired Access: Generic Read/Write, Delete, Write DAC, Write Owner, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened |
| 4:11:22.4597759 PM | 4:11:22.4609634 PM | CreateFile | NAME NOT FOUND | \\nurl\MyServer\ | Desired Access: Write Data/Add File, Synchronize, Disposition: Open, Options: , Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a |
| 4:11:22.4633385 PM | 4:11:22.4651353 PM | CreateFile | SUCCESS | \\nurl\MyServer\FFB435A4.tmp | Desired Access: Read Attributes, Delete, Disposition: Open, Options: Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened |
| Index | Start | End | IRP MAJOR:MINOR | Status:Information | Path:RelatedPath | Detail | Detail2 |
|---|---|---|---|---|---|---|---|
| 000001 | 16:09:32.994737 | 16:09:32.994740 | 0:CREATE[0] | 0:SUCCESS [1] | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-191928960:] PrimaryToken ProcessAuditId] | |
| 000002 | 16:09:32.994744 | 16:09:32.994745 | 14:DEVICE_CONTROL[0] | 0:SUCCESS [30] | IOCTL[CD30E008] Device[CD30:] Cmd:2050 Access 3 Method 0:BUFFERED | ||
| 000003 | 16:09:33.008246 | 16:09:33.008249 | 0:CREATE[0] | 0:SUCCESS [1] | 1:OPEN 1:OPENED Opt[1000040:|NON_DIRECTORY_FILE] Name[] Type[] | SecurityContext: FullOptions[40:|NON_DIRECTORY_FILE] Access[20:|EXECUTE] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[20:|EXECUTE] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[20:|EXECUTE] SubjectSecurityContext[ImpersonationLevel[245699961:] PrimaryToken ProcessAuditId] | |
| 000004 | 16:09:33.008255 | 16:09:33.008255 | 18:CLEANUP[0] | 0:SUCCESS [0] | |||
| 000005 | 16:09:34.306138 | 16:09:34.306143 | 0:CREATE[0] | 0:SUCCESS [1] | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-191928960:] PrimaryToken ProcessAuditId] | |
| 000006 | 16:09:34.306148 | 16:09:34.306149 | 14:DEVICE_CONTROL[0] | 0:SUCCESS [30] | IOCTL[CD30E008] Device[CD30:] Cmd:2050 Access 3 Method 0:BUFFERED | ||
| 000007 | 16:09:47.397335 | 16:09:47.397339 | 0:CREATE[0] | 0:SUCCESS [1] | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-233523840:] PrimaryToken ProcessAuditId] | |
| 000008 | 16:09:47.397346 | 16:09:47.397347 | 14:DEVICE_CONTROL[0] | 0:SUCCESS [30] | IOCTL[CD30E008] Device[CD30:] Cmd:2050 Access 3 Method 0:BUFFERED | ||
| 000009 | 16:10:45.847319 | 16:10:45.847322 | 0:CREATE[0] | 0:SUCCESS [1] | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-192398144:] PrimaryToken ProcessAuditId] | |
| 000010 | 16:10:45.847328 | 16:10:45.847329 | 14:DEVICE_CONTROL[0] | 0:SUCCESS [30] | IOCTL[CD30E008] Device[CD30:] Cmd:2050 Access 3 Method 0:BUFFERED | ||
| 000011 | 16:10:55.458733 | 16:10:55.459272 | 14:DEVICE_CONTROL[0] | 0:SUCCESS [4] | IOCTL[140193] Device[14:DEVICE_NETWORK_FILE_SYSTEM] Cmd:100 Access 0 Method 3:NEITHER Path[\nurl\IPC$] Accepted[10:\nurl] | ||
| 000012 | 16:10:55.459279 | 16:10:55.459830 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\IPC$ | 3:OPEN_IF 0:SUPERSEDED Opt[30000A0:|SYNCHRONOUS_IO_NONALERT|CREATE_TREE_CONNECTION] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[A0:|SYNCHRONOUS_IO_NONALERT|CREATE_TREE_CONNECTION] Access[100000:|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[100000:|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100000:|SYNC] SubjectSecurityContext[ImpersonationLevel[2:Impersonation] PrimaryToken ProcessAuditId] |
| 000013 | 16:10:55.459848 | 16:10:55.460275 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [1000] | \nurl\IPC$ | USER FSCTL[65:FSCTL_SET_ZERO_ON_DEALLOCATION] | |
| 000014 | 16:10:55.460282 | 16:10:55.460495 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\IPC$ | USER FSCTL[6B:FSCTL_CSC_INTERNAL] | |
| 000015 | 16:10:55.460501 | 16:10:55.460550 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\IPC$ | ||
| 000016 | 16:10:55.460553 | 16:10:55.460601 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\IPC$ | ||
| 000017 | 16:10:55.460693 | 16:10:55.461607 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000018 | 16:10:55.461651 | 16:10:55.461670 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000019 | 16:10:55.461678 | 16:10:55.461707 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000020 | 16:10:55.461709 | 16:10:55.461786 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000021 | 16:10:55.466828 | 16:10:55.466956 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000022 | 16:10:55.466963 | 16:10:55.467002 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000023 | 16:10:55.467006 | 16:10:55.467026 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000024 | 16:10:55.467072 | 16:10:55.467202 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-192398144:] PrimaryToken ProcessAuditId] |
| 000025 | 16:10:55.469150 | 16:10:55.469222 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000026 | 16:10:55.469227 | 16:10:55.469250 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000027 | 16:10:55.469253 | 16:10:55.469270 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000028 | 16:10:55.469293 | 16:10:55.469405 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000029 | 16:10:57.925206 | 16:10:57.927310 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000030 | 16:10:57.927322 | 16:10:57.927348 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000031 | 16:10:57.927352 | 16:10:57.927368 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000032 | 16:10:57.927423 | 16:10:57.927474 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000033 | 16:10:57.927497 | 16:10:57.927498 | 6:SET_INFORMATION[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\PIPE\wkssvc \nurl\PIPE\wkssvc | 23:FilePipeInformation | |
| 000034 | 16:10:57.927507 | 16:10:57.927530 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | ||
| 000035 | 16:10:57.927532 | 16:10:57.927547 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | ||
| 000036 | 16:10:57.975178 | 16:10:57.985119 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000037 | 16:10:57.985129 | 16:10:57.985158 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000038 | 16:10:57.985161 | 16:10:57.985200 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000039 | 16:10:57.985242 | 16:10:57.986267 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1000021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[21:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100001:|READ_DATA|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000040 | 16:10:57.986303 | 16:10:57.986516 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [70] | \nurl\MyServer\ | 1:QUERY Test.txt | |
| 000041 | 16:10:57.986534 | 16:10:57.986568 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000042 | 16:10:57.986570 | 16:10:57.986608 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000043 | 16:10:58.041138 | 16:10:58.051641 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-849084416:] PrimaryToken ProcessAuditId] |
| 000044 | 16:10:58.051651 | 16:10:58.051679 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000045 | 16:10:58.051681 | 16:10:58.051718 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000046 | 16:10:58.051753 | 16:10:58.111788 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-192398144:] PrimaryToken ProcessAuditId] |
| 000047 | 16:10:58.111881 | 16:10:58.111936 | 3:READ[0] | 0:SUCCESS [18] | \nurl\MyServer\Test.txt | Pos[0:24] | |
| 000048 | 16:10:58.111967 | 16:10:58.111993 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000049 | 16:10:58.111995 | 16:10:58.112026 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000050 | 16:10:58.112078 | 16:10:58.113966 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000051 | 16:10:58.113976 | 16:10:58.114006 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000052 | 16:10:58.114009 | 16:10:58.114050 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000053 | 16:10:58.114097 | 16:10:58.115286 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1400060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_NO_RECALL] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[400060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_NO_RECALL] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000054 | 16:10:58.115312 | 16:10:58.115317 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\Test.txt | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000055 | 16:10:58.115521 | 16:10:58.116053 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000056 | 16:10:58.116083 | 16:10:58.116158 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000057 | 16:10:58.116163 | 16:10:58.116212 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000058 | 16:10:58.116250 | 16:10:58.116742 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200044:|SEQUENTIAL_ONLY|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200044:|SEQUENTIAL_ONLY|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Access[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000059 | 16:10:58.116763 | 16:10:58.116765 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\Test.txt | 35:FileAttributeTagInformation Attr[20:|ARCHIVE] Reparse[0] | |
| 000060 | 16:10:58.116767 | 16:10:58.116770 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\Test.txt | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000061 | 16:10:58.116779 | 16:10:58.117368 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer\Test.txt | USER FSCTL[E4:FSCTL_QUERY_VOLUME_CONTAINER_STATE] | |
| 000062 | 16:10:58.117383 | 16:10:58.117785 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer\Test.txt | USER FSCTL[71:] | |
| 000063 | 16:10:58.117813 | 16:10:58.117814 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [18] | \nurl\MyServer\Test.txt | 5:FileStandardInformation | |
| 000064 | 16:10:58.117816 | 16:10:58.117817 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000065 | 16:10:58.117859 | 16:10:58.117860 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [FFE] | \nurl\MyServer\Test.txt | 22:FileStreamInformation | |
| 000066 | 16:10:58.117865 | 16:10:58.117866 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000067 | 16:10:58.117871 | 16:10:58.117872 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [4] | \nurl\MyServer\Test.txt | 7:FileEaInformation | |
| 000068 | 16:10:58.118743 | 16:10:58.118751 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [16] | \nurl\MyServer\Test.txt | 5:FileFsAttributeInformation FAT Attributes[586:CASE_PRESERVED_NAMES|UNICODE_ON_DISK|SUPPORTS_REPARSE_POINTS|SUPPORTS_REMOTE_STORAGE|SUPPORTS_POSIX_UNLINK_RENAME] MaxName:255 | |
| 000069 | 16:10:58.118765 | 16:10:58.118767 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\Test.txt | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000070 | 16:10:58.121353 | 16:10:58.121362 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\Test.txt | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000071 | 16:10:58.121379 | 16:10:58.121381 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [10A] | \nurl\MyServer\Test.txt | 49:FileNetworkPhysicalNameInformation \nurl\MyServer\Test.txt | |
| 000072 | 16:10:58.121385 | 16:10:58.121388 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\Test.txt | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000073 | 16:10:58.121394 | 16:10:58.121706 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer\Test.txt | 55:FileRemoteProtocolInformation | |
| 000074 | 16:10:58.121864 | 16:10:58.121867 | 6:SET_INFORMATION[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt \nurl\MyServer\Test.txt | 14:FilePositionInformation | |
| 000075 | 16:10:58.121951 | 16:10:58.125054 | 3:READ[0] | 0:SUCCESS [40000] | \nurl\MyServer\Test.txt | Pos[0:262144] | |
| 000076 | 16:10:58.122021 | 16:10:58.125726 | 3:READ[0] | 0:SUCCESS [40000] | \nurl\MyServer\Test.txt | Pos[262,144:262144] | |
| 000077 | 16:10:58.122110 | 16:10:58.126405 | 3:READ[0] | 0:SUCCESS [40000] | \nurl\MyServer\Test.txt | Pos[524,288:262144] | |
| 000078 | 16:10:58.122241 | 16:10:58.126803 | 3:READ[0] | 0:SUCCESS [40000] | \nurl\MyServer\Test.txt | Pos[786,432:262144] | |
| 000079 | 16:10:58.122311 | 16:10:58.128003 | 3:READ[0] | 0:SUCCESS [34F6F] | \nurl\MyServer\Test.txt | Pos[1,048,576:262144] | |
| 000080 | 16:10:58.139590 | 16:10:58.154073 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000081 | 16:10:58.154080 | 16:10:58.154124 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000082 | 16:10:58.156926 | 16:10:58.156934 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [18] | \nurl\MyServer\Test.txt | 5:FileStandardInformation | |
| 000083 | 16:10:58.171899 | 00:00:00.000000 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-1197407685:] PrimaryToken ProcessAuditId] |
| 000084 | 16:10:58.177492 | 16:10:58.177526 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000085 | 16:10:58.177529 | 16:10:58.177567 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000086 | 16:10:58.177610 | 16:10:58.178101 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-192398144:] PrimaryToken ProcessAuditId] |
| 000087 | 16:10:58.178119 | 16:10:58.178163 | 3:READ[0] | 0:SUCCESS [18] | \nurl\MyServer\Test.txt | Pos[0:24] | |
| 000088 | 16:10:58.178175 | 16:10:58.178200 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000089 | 16:10:58.178201 | 16:10:58.178231 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000090 | 16:10:58.182531 | 16:10:58.183126 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[956025456:] PrimaryToken ProcessAuditId] |
| 000091 | 16:10:58.183133 | 16:10:58.183162 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000092 | 16:10:58.183165 | 16:10:58.183244 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000093 | 16:10:58.183298 | 16:10:58.183752 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000094 | 16:10:58.183759 | 16:10:58.183788 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000095 | 16:10:58.183791 | 16:10:58.183848 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000096 | 16:10:58.183881 | 16:10:58.185895 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188509760:] PrimaryToken ProcessAuditId] |
| 000097 | 16:10:58.185908 | 16:10:58.185912 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000098 | 16:10:58.185914 | 16:10:58.185951 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000099 | 16:10:58.185954 | 16:10:58.185989 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000100 | 16:10:58.200557 | 00:00:00.000000 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000101 | 16:10:58.209402 | 16:10:58.209473 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000102 | 16:10:58.209476 | 16:10:58.209515 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000103 | 16:10:58.209564 | 16:10:58.209932 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000104 | 16:10:58.209937 | 16:10:58.209964 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000105 | 16:10:58.209967 | 16:10:58.210006 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000106 | 16:10:58.210046 | 16:10:58.211083 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000107 | 16:10:58.211097 | 16:10:58.211099 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000108 | 16:10:58.211101 | 16:10:58.211138 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000109 | 16:10:58.211140 | 16:10:58.211174 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000110 | 16:10:58.211264 | 16:10:58.211774 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000111 | 16:10:58.211785 | 16:10:58.211815 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000112 | 16:10:58.211818 | 16:10:58.211858 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000113 | 16:10:58.211914 | 16:10:58.212358 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000114 | 16:10:58.212367 | 16:10:58.212537 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000115 | 16:10:58.212542 | 16:10:58.212584 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000116 | 16:10:58.212630 | 16:10:58.213175 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000117 | 16:10:58.213182 | 16:10:58.213184 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000118 | 16:10:58.213185 | 16:10:58.213231 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000119 | 16:10:58.213233 | 16:10:58.213264 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000120 | 16:10:58.213323 | 16:10:58.213830 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000121 | 16:10:58.213841 | 16:10:58.213869 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000122 | 16:10:58.213872 | 16:10:58.213910 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000123 | 16:10:58.213954 | 16:10:58.214290 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000124 | 16:10:58.214295 | 16:10:58.214323 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000125 | 16:10:58.214326 | 16:10:58.214362 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000126 | 16:10:58.214500 | 16:10:58.215198 | 0:CREATE[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer\Test.txt:Zone.Identifier | 1:OPEN 0:SUPERSEDED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000127 | 16:10:58.252765 | 16:10:58.253305 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[12:] PrimaryToken ProcessAuditId] |
| 000128 | 16:10:58.253312 | 16:10:58.253339 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000129 | 16:10:58.253341 | 16:10:58.253378 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000130 | 16:10:58.253406 | 16:10:58.253789 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000131 | 16:10:58.253794 | 16:10:58.253819 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000132 | 16:10:58.253821 | 16:10:58.253857 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000133 | 16:10:58.253879 | 16:10:58.254335 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-190481407:] PrimaryToken ProcessAuditId] |
| 000134 | 16:10:58.254341 | 16:10:58.254343 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000135 | 16:10:58.254344 | 16:10:58.254368 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000136 | 16:10:58.254369 | 16:10:58.254437 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000137 | 16:10:58.254582 | 16:10:58.255054 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000138 | 16:10:58.255059 | 16:10:58.255087 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000139 | 16:10:58.255089 | 16:10:58.255124 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000140 | 16:10:58.255153 | 16:10:58.255845 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000141 | 16:10:58.255852 | 16:10:58.255970 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000142 | 16:10:58.255973 | 16:10:58.256019 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000143 | 16:10:58.256047 | 16:10:58.256680 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-190481407:] PrimaryToken ProcessAuditId] |
| 000144 | 16:10:58.256687 | 16:10:58.256689 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000145 | 16:10:58.256690 | 16:10:58.256715 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000146 | 16:10:58.256717 | 16:10:58.256747 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000147 | 16:10:58.256805 | 16:10:58.257153 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000148 | 16:10:58.257157 | 16:10:58.257186 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000149 | 16:10:58.257189 | 16:10:58.257234 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000150 | 16:10:58.257263 | 16:10:58.257653 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000151 | 16:10:58.257658 | 16:10:58.257683 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000152 | 16:10:58.257685 | 16:10:58.257721 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000153 | 16:10:58.257743 | 16:10:58.261285 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\~$Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-190481407:] PrimaryToken ProcessAuditId] |
| 000154 | 16:10:58.261294 | 16:10:58.261296 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\~$Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/23 05:30:18.235] A[2018/06/27 10:57:17.145] W[2018/06/27 10:57:17.145] Ch[2018/06/27 10:57:17.145] EOF[162] Attr[22:|HIDDEN|ARCHIVE] | |
| 000155 | 16:10:58.261297 | 16:10:58.261325 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\~$Test.txt | ||
| 000156 | 16:10:58.261327 | 16:10:58.261358 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\~$Test.txt | ||
| 000157 | 16:10:58.261403 | 16:10:58.261794 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000158 | 16:10:58.261800 | 16:10:58.261825 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000159 | 16:10:58.261828 | 16:10:58.261875 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000160 | 16:10:58.261908 | 16:10:58.262243 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000161 | 16:10:58.262247 | 16:10:58.262272 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000162 | 16:10:58.262274 | 16:10:58.262310 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000163 | 16:10:58.262331 | 16:10:58.262879 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\~$Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-190481407:] PrimaryToken ProcessAuditId] |
| 000164 | 16:10:58.262885 | 16:10:58.262887 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\~$Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/23 05:30:18.235] A[2018/06/27 10:57:17.145] W[2018/06/27 10:57:17.145] Ch[2018/06/27 10:57:17.145] EOF[162] Attr[22:|HIDDEN|ARCHIVE] | |
| 000165 | 16:10:58.262887 | 16:10:58.262913 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\~$Test.txt | ||
| 000166 | 16:10:58.262914 | 16:10:58.262945 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\~$Test.txt | ||
| 000167 | 16:10:58.262979 | 16:10:58.263590 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[246955795:] PrimaryToken ProcessAuditId] |
| 000168 | 16:10:58.263598 | 16:10:58.263673 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000169 | 16:10:58.263678 | 16:10:58.263721 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000170 | 16:10:58.263757 | 16:10:58.264309 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\~$Test.txt | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[120089:|READ_DATA|READ_EA|READ_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000171 | 16:10:58.264348 | 16:10:58.264414 | 3:READ[0] | 0:SUCCESS [18] | \nurl\MyServer\~$Test.txt | Pos[0:24] | |
| 000172 | 16:10:58.264425 | 16:10:58.264452 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\~$Test.txt | ||
| 000173 | 16:10:58.264454 | 16:10:58.264493 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\~$Test.txt | ||
| 000174 | 16:11:02.261383 | 16:11:02.262922 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000175 | 16:11:02.262932 | 16:11:02.262961 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000176 | 16:11:02.262964 | 16:11:02.263003 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000177 | 16:11:02.263034 | 16:11:02.263366 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000178 | 16:11:02.263370 | 16:11:02.263396 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000179 | 16:11:02.263398 | 16:11:02.263431 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000180 | 16:11:02.263462 | 16:11:02.263927 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188509760:] PrimaryToken ProcessAuditId] |
| 000181 | 16:11:02.263933 | 16:11:02.263935 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000182 | 16:11:02.263935 | 16:11:02.263958 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000183 | 16:11:02.263960 | 16:11:02.263988 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000184 | 16:11:02.264079 | 16:11:02.264414 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000185 | 16:11:02.264419 | 16:11:02.264443 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000186 | 16:11:02.264446 | 16:11:02.264553 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000187 | 16:11:02.264580 | 16:11:02.264912 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000188 | 16:11:02.264916 | 16:11:02.264940 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000189 | 16:11:02.264942 | 16:11:02.264975 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000190 | 16:11:02.264993 | 16:11:02.265306 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188509760:] PrimaryToken ProcessAuditId] |
| 000191 | 16:11:02.265311 | 16:11:02.265312 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000192 | 16:11:02.265313 | 16:11:02.265338 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000193 | 16:11:02.265340 | 16:11:02.265373 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000194 | 16:11:02.276934 | 16:11:02.279433 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-849084416:] PrimaryToken ProcessAuditId] |
| 000195 | 16:11:02.279440 | 16:11:02.279469 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000196 | 16:11:02.279472 | 16:11:02.279985 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000197 | 16:11:02.280140 | 16:11:02.285098 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000198 | 16:11:02.285127 | 16:11:02.285130 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000199 | 16:11:02.285138 | 16:11:02.285172 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000200 | 16:11:02.285175 | 16:11:02.285214 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000201 | 16:11:02.285650 | 16:11:02.285802 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000202 | 16:11:02.285807 | 16:11:02.285833 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000203 | 16:11:02.285836 | 16:11:02.285854 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000204 | 16:11:02.285886 | 16:11:02.285969 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000205 | 16:11:02.289008 | 16:11:02.289125 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000206 | 16:11:02.289131 | 16:11:02.289161 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000207 | 16:11:02.289165 | 16:11:02.289184 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000208 | 16:11:02.289225 | 16:11:02.289289 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000209 | 16:11:02.309698 | 16:11:02.317758 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000210 | 16:11:02.316647 | 16:11:02.318188 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000211 | 16:11:02.317770 | 16:11:02.318230 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000212 | 16:11:02.318198 | 16:11:02.318257 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000213 | 16:11:02.318233 | 16:11:02.318300 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000214 | 16:11:02.318260 | 16:11:02.318394 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000215 | 16:11:02.318349 | 16:11:02.318868 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000216 | 16:11:02.318424 | 16:11:02.319192 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000217 | 16:11:02.318875 | 16:11:02.319224 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000218 | 16:11:02.319198 | 16:11:02.319248 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000219 | 16:11:02.319226 | 16:11:02.319285 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000220 | 16:11:02.319250 | 16:11:02.319352 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000221 | 16:11:02.319312 | 16:11:02.319891 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000222 | 16:11:02.319371 | 16:11:02.320236 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-243551760:] PrimaryToken ProcessAuditId] |
| 000223 | 16:11:02.319897 | 16:11:02.319899 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000224 | 16:11:02.319900 | 16:11:02.320272 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000225 | 16:11:02.320242 | 16:11:02.320244 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000226 | 16:11:02.320246 | 16:11:02.320296 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000227 | 16:11:02.320274 | 16:11:02.320327 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000228 | 16:11:02.320297 | 16:11:02.320435 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000229 | 16:11:02.320373 | 16:11:02.320867 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000230 | 16:11:02.320477 | 16:11:02.321185 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000231 | 16:11:02.320872 | 16:11:02.321216 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000232 | 16:11:02.321190 | 16:11:02.321240 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000233 | 16:11:02.321218 | 16:11:02.321278 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000234 | 16:11:02.321242 | 16:11:02.321348 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000235 | 16:11:02.321306 | 16:11:02.321731 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000236 | 16:11:02.321368 | 16:11:02.322048 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000237 | 16:11:02.321737 | 16:11:02.322077 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000238 | 16:11:02.322051 | 16:11:02.322101 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000239 | 16:11:02.322079 | 16:11:02.322140 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000240 | 16:11:02.322104 | 16:11:02.322206 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000241 | 16:11:02.322164 | 16:11:02.322828 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000242 | 16:11:02.322223 | 16:11:02.323568 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-243551760:] PrimaryToken ProcessAuditId] |
| 000243 | 16:11:02.322835 | 16:11:02.322836 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000244 | 16:11:02.322838 | 16:11:02.323679 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000245 | 16:11:02.323595 | 16:11:02.323597 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000246 | 16:11:02.323597 | 16:11:02.323764 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000247 | 16:11:02.323703 | 16:11:02.323833 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000248 | 16:11:02.323782 | 16:11:02.324743 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000249 | 16:11:02.404601 | 16:11:02.418434 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-849215488:] PrimaryToken ProcessAuditId] |
| 000250 | 16:11:02.418479 | 16:11:02.418536 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000251 | 16:11:02.418540 | 16:11:02.418583 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000252 | 16:11:02.418647 | 16:11:02.419164 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000253 | 16:11:02.419198 | 16:11:02.419203 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000254 | 16:11:02.419213 | 16:11:02.419249 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000255 | 16:11:02.419251 | 16:11:02.419310 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000256 | 16:11:02.419728 | 16:11:02.419802 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000257 | 16:11:02.419807 | 16:11:02.419834 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000258 | 16:11:02.419837 | 16:11:02.419858 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000259 | 16:11:02.420001 | 16:11:02.420079 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000260 | 16:11:02.421953 | 16:11:02.422014 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000261 | 16:11:02.422019 | 16:11:02.422043 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000262 | 16:11:02.422046 | 16:11:02.422064 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000263 | 16:11:02.422088 | 16:11:02.422145 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000264 | 16:11:02.433943 | 16:11:02.455669 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000265 | 16:11:02.455680 | 16:11:02.455714 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000266 | 16:11:02.455717 | 16:11:02.455759 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000267 | 16:11:02.455797 | 16:11:02.457241 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000268 | 16:11:02.457247 | 16:11:02.457277 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000269 | 16:11:02.457280 | 16:11:02.457320 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000270 | 16:11:02.457344 | 16:11:02.457829 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-194307327:] PrimaryToken ProcessAuditId] |
| 000271 | 16:11:02.457836 | 16:11:02.457838 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000272 | 16:11:02.457839 | 16:11:02.457870 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000273 | 16:11:02.457871 | 16:11:02.457903 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000274 | 16:11:02.459380 | 16:11:02.459779 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000275 | 16:11:02.459784 | 16:11:02.459813 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000276 | 16:11:02.459816 | 16:11:02.459855 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000277 | 16:11:02.459878 | 16:11:02.460627 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000278 | 16:11:02.460633 | 16:11:02.460663 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000279 | 16:11:02.460666 | 16:11:02.460705 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000280 | 16:11:02.460725 | 16:11:02.461210 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-189875455:] PrimaryToken ProcessAuditId] |
| 000281 | 16:11:02.461216 | 16:11:02.461218 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000282 | 16:11:02.461221 | 16:11:02.461249 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000283 | 16:11:02.461250 | 16:11:02.461295 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000284 | 16:11:02.461318 | 16:11:02.461668 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000285 | 16:11:02.461672 | 16:11:02.461700 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000286 | 16:11:02.461702 | 16:11:02.461740 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000287 | 16:11:02.461764 | 16:11:02.462184 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000288 | 16:11:02.462189 | 16:11:02.462218 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000289 | 16:11:02.462220 | 16:11:02.462258 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000290 | 16:11:02.462279 | 16:11:02.462732 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-189875455:] PrimaryToken ProcessAuditId] |
| 000291 | 16:11:02.462737 | 16:11:02.462739 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000292 | 16:11:02.462741 | 16:11:02.462772 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000293 | 16:11:02.462774 | 16:11:02.462809 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000294 | 16:11:02.462832 | 16:11:02.463203 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[246955795:] PrimaryToken ProcessAuditId] |
| 000295 | 16:11:02.463208 | 16:11:02.463236 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000296 | 16:11:02.463239 | 16:11:02.463277 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000297 | 16:11:02.463298 | 16:11:02.463628 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1000021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[21:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100001:|READ_DATA|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-196428608:] PrimaryToken ProcessAuditId] |
| 000298 | 16:11:02.463635 | 16:11:02.463773 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [70] | \nurl\MyServer\ | 1:QUERY Test.txt | |
| 000299 | 16:11:02.463778 | 16:11:02.463809 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000300 | 16:11:02.463811 | 16:11:02.463849 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000301 | 16:11:02.482648 | 16:11:02.510731 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000302 | 16:11:02.510744 | 16:11:02.510788 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000303 | 16:11:02.510793 | 16:11:02.510839 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000304 | 16:11:02.510886 | 16:11:02.511383 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000305 | 16:11:02.511394 | 16:11:02.511427 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000306 | 16:11:02.511448 | 16:11:02.511507 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000307 | 16:11:02.511545 | 16:11:02.512015 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[956028880:] PrimaryToken ProcessAuditId] |
| 000308 | 16:11:02.512026 | 16:11:02.512030 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\ | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000309 | 16:11:02.512031 | 16:11:02.512070 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000310 | 16:11:02.512072 | 16:11:02.512190 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000311 | 16:11:02.591872 | 16:11:02.622168 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848691200:] PrimaryToken ProcessAuditId] |
| 000312 | 16:11:02.636082 | 16:11:02.652608 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000313 | 16:11:02.652617 | 16:11:02.652698 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000314 | 16:11:02.652763 | 16:11:02.653304 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000315 | 16:11:02.653324 | 16:11:02.653329 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000316 | 16:11:02.653335 | 16:11:02.653378 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000317 | 16:11:02.653384 | 16:11:02.653429 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000318 | 16:11:02.653812 | 16:11:02.653896 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000319 | 16:11:02.653902 | 16:11:02.653931 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000320 | 16:11:02.653934 | 16:11:02.653954 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000321 | 16:11:02.653986 | 16:11:02.654047 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[-196428608:] PrimaryToken ProcessAuditId] |
| 000322 | 16:11:02.655689 | 16:11:02.655754 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000323 | 16:11:02.655759 | 16:11:02.655787 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000324 | 16:11:02.655789 | 16:11:02.655812 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000325 | 16:11:02.655833 | 16:11:02.655890 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000326 | 16:11:06.334933 | 16:11:06.347944 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000327 | 16:11:06.347959 | 16:11:06.347991 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000328 | 16:11:06.347995 | 16:11:06.348034 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000329 | 16:11:06.348077 | 16:11:06.359291 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[703406188:] PrimaryToken ProcessAuditId] |
| 000330 | 16:11:06.359308 | 16:11:06.359310 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000331 | 16:11:06.359313 | 16:11:06.359866 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000332 | 16:11:06.359880 | 16:11:06.359967 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000333 | 16:11:06.359970 | 16:11:06.360012 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000334 | 16:11:06.399885 | 16:11:06.400321 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000335 | 16:11:06.400328 | 16:11:06.400353 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000336 | 16:11:06.400356 | 16:11:06.400393 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000337 | 16:11:06.400485 | 16:11:06.400939 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[-196428608:] PrimaryToken ProcessAuditId] |
| 000338 | 16:11:06.400949 | 16:11:06.401408 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer | 55:FileRemoteProtocolInformation | |
| 000339 | 16:11:06.401412 | 16:11:06.401716 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [84] | \nurl\MyServer | 1:QUERY Test.txt | |
| 000340 | 16:11:06.401721 | 16:11:06.401751 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000341 | 16:11:06.401753 | 16:11:06.401793 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000342 | 16:11:06.404139 | 16:11:06.404792 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-859832320:] PrimaryToken ProcessAuditId] |
| 000343 | 16:11:06.404799 | 16:11:06.404843 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000344 | 16:11:06.404846 | 16:11:06.404885 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000345 | 16:11:06.404962 | 16:11:06.405474 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000346 | 16:11:06.405487 | 16:11:06.405489 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000347 | 16:11:06.405493 | 16:11:06.405567 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000348 | 16:11:06.405570 | 16:11:06.405644 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000349 | 16:11:06.405871 | 16:11:06.405935 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000350 | 16:11:06.405941 | 16:11:06.405967 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000351 | 16:11:06.405970 | 16:11:06.405987 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000352 | 16:11:06.406051 | 16:11:06.406114 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000353 | 16:11:06.408164 | 16:11:06.408245 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000354 | 16:11:06.408250 | 16:11:06.408273 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000355 | 16:11:06.408276 | 16:11:06.408292 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000356 | 16:11:06.408314 | 16:11:06.408369 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000357 | 16:11:06.410189 | 16:11:06.410712 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000358 | 16:11:06.410718 | 16:11:06.410761 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000359 | 16:11:06.410763 | 16:11:06.410802 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000360 | 16:11:06.410826 | 16:11:06.411435 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000361 | 16:11:06.411468 | 16:11:06.411471 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000362 | 16:11:06.411474 | 16:11:06.411823 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000363 | 16:11:06.411833 | 16:11:06.411873 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000364 | 16:11:06.411875 | 16:11:06.411910 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000365 | 16:11:06.445850 | 16:11:06.463133 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848560128:] PrimaryToken ProcessAuditId] |
| 000366 | 16:11:06.463143 | 16:11:06.463171 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000367 | 16:11:06.463174 | 16:11:06.463211 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000368 | 16:11:06.463255 | 16:11:06.463582 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000369 | 16:11:06.463594 | 16:11:06.463596 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000370 | 16:11:06.463601 | 16:11:06.463626 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000371 | 16:11:06.463627 | 16:11:06.463717 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000372 | 16:11:06.464002 | 16:11:06.464049 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000373 | 16:11:06.464053 | 16:11:06.464076 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000374 | 16:11:06.464079 | 16:11:06.464097 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000375 | 16:11:06.464122 | 16:11:06.464177 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000376 | 16:11:06.465902 | 16:11:06.465962 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000377 | 16:11:06.465965 | 16:11:06.465992 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000378 | 16:11:06.465996 | 16:11:06.466014 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000379 | 16:11:06.466036 | 16:11:06.466090 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000380 | 16:11:06.467828 | 16:11:06.468323 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000381 | 16:11:06.468328 | 16:11:06.468354 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000382 | 16:11:06.468356 | 16:11:06.468428 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000383 | 16:11:06.468451 | 16:11:06.468835 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000384 | 16:11:06.468845 | 16:11:06.468847 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 000385 | 16:11:06.468849 | 16:11:06.469267 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000386 | 16:11:06.469291 | 16:11:06.469343 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000387 | 16:11:06.469346 | 16:11:06.469402 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000388 | 16:11:06.471273 | 16:11:06.471905 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848494592:] PrimaryToken ProcessAuditId] |
| 000389 | 16:11:06.471912 | 16:11:06.471949 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000390 | 16:11:06.471952 | 16:11:06.472011 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000391 | 16:11:06.472061 | 16:11:06.473536 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000392 | 16:11:06.473564 | 16:11:06.473567 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000393 | 16:11:06.473575 | 16:11:06.473611 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000394 | 16:11:06.473613 | 16:11:06.473702 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000395 | 16:11:06.473940 | 16:11:06.474002 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000396 | 16:11:06.474008 | 16:11:06.474037 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000397 | 16:11:06.474040 | 16:11:06.474082 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000398 | 16:11:06.474112 | 16:11:06.474180 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000399 | 16:11:06.477397 | 16:11:06.477488 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000400 | 16:11:06.477493 | 16:11:06.477519 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000401 | 16:11:06.477522 | 16:11:06.477540 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000402 | 16:11:06.477563 | 16:11:06.477623 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000403 | 16:11:06.479478 | 16:11:06.479882 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000404 | 16:11:06.479888 | 16:11:06.479916 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000405 | 16:11:06.479918 | 16:11:06.479957 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000406 | 16:11:06.479979 | 16:11:06.480319 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000407 | 16:11:06.480328 | 16:11:06.480330 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 000408 | 16:11:06.480332 | 16:11:06.480812 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000409 | 16:11:06.480838 | 16:11:06.480912 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000410 | 16:11:06.480914 | 16:11:06.480955 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000411 | 16:11:06.483842 | 16:11:06.484301 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848429056:] PrimaryToken ProcessAuditId] |
| 000412 | 16:11:06.484307 | 16:11:06.484340 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000413 | 16:11:06.484343 | 16:11:06.484384 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000414 | 16:11:06.484408 | 16:11:06.484780 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000415 | 16:11:06.484789 | 16:11:06.484791 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000416 | 16:11:06.484795 | 16:11:06.484823 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000417 | 16:11:06.484824 | 16:11:06.484861 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000418 | 16:11:06.485009 | 16:11:06.485059 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000419 | 16:11:06.485063 | 16:11:06.485087 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000420 | 16:11:06.485090 | 16:11:06.485108 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000421 | 16:11:06.485132 | 16:11:06.485187 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000422 | 16:11:06.486643 | 16:11:06.486704 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000423 | 16:11:06.486738 | 16:11:06.486773 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000424 | 16:11:06.486776 | 16:11:06.486795 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000425 | 16:11:06.486820 | 16:11:06.486876 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000426 | 16:11:06.679869 | 00:00:00.000000 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-869203968:] PrimaryToken ProcessAuditId] |
| 000427 | 16:11:06.758937 | 16:11:06.759099 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000428 | 16:11:06.759105 | 16:11:06.759158 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000429 | 16:11:06.759209 | 16:11:06.759618 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000430 | 16:11:06.759631 | 16:11:06.759632 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000431 | 16:11:06.759637 | 16:11:06.759662 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000432 | 16:11:06.759664 | 16:11:06.759698 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000433 | 16:11:06.759858 | 16:11:06.759913 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000434 | 16:11:06.759917 | 16:11:06.759939 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000435 | 16:11:06.759941 | 16:11:06.759956 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000436 | 16:11:06.759986 | 16:11:06.760039 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000437 | 16:11:06.761512 | 16:11:06.761606 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000438 | 16:11:06.761610 | 16:11:06.761633 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000439 | 16:11:06.761636 | 16:11:06.761652 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000440 | 16:11:06.761688 | 16:11:06.761743 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000441 | 16:11:06.763414 | 16:11:06.763794 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000442 | 16:11:06.763799 | 16:11:06.763824 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000443 | 16:11:06.763826 | 16:11:06.763867 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000444 | 16:11:06.763888 | 16:11:06.764354 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000445 | 16:11:06.764362 | 16:11:06.764363 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000446 | 16:11:06.764365 | 16:11:06.764888 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000447 | 16:11:06.764904 | 16:11:06.764978 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000448 | 16:11:06.764980 | 16:11:06.765014 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000449 | 16:11:06.798122 | 16:11:06.818741 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-864747520:] PrimaryToken ProcessAuditId] |
| 000450 | 16:11:06.858139 | 16:11:06.864537 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000451 | 16:11:06.864543 | 16:11:06.864597 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000452 | 16:11:06.864644 | 16:11:06.865150 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000453 | 16:11:06.865162 | 16:11:06.865164 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000454 | 16:11:06.865168 | 16:11:06.865244 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000455 | 16:11:06.865246 | 16:11:06.865289 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000456 | 16:11:06.865453 | 16:11:06.865505 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000457 | 16:11:06.865508 | 16:11:06.865534 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000458 | 16:11:06.865536 | 16:11:06.865554 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000459 | 16:11:06.865577 | 16:11:06.865640 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000460 | 16:11:06.868022 | 16:11:06.870123 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000461 | 16:11:06.870138 | 16:11:06.870169 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000462 | 16:11:06.870173 | 16:11:06.870191 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000463 | 16:11:06.870266 | 16:11:06.870348 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000464 | 16:11:06.872682 | 16:11:06.873283 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000465 | 16:11:06.873294 | 16:11:06.873321 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000466 | 16:11:06.873324 | 16:11:06.873361 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000467 | 16:11:06.873392 | 16:11:06.873931 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000468 | 16:11:06.873943 | 16:11:06.873944 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000469 | 16:11:06.873947 | 16:11:06.874418 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000470 | 16:11:06.874426 | 16:11:06.874479 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000471 | 16:11:06.874481 | 16:11:06.874530 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000472 | 16:11:06.972362 | 16:11:06.975001 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000473 | 16:11:07.014401 | 16:11:07.122012 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000474 | 16:11:07.122021 | 16:11:07.122068 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000475 | 16:11:07.122122 | 16:11:07.122719 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000476 | 16:11:07.122772 | 16:11:07.123804 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer | 55:FileRemoteProtocolInformation | |
| 000477 | 16:11:07.123814 | 16:11:07.124145 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [84] | \nurl\MyServer | 1:QUERY Test.txt | |
| 000478 | 16:11:07.124153 | 16:11:07.124187 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000479 | 16:11:07.124188 | 16:11:07.124230 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000480 | 16:11:07.126215 | 16:11:07.126755 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848625664:] PrimaryToken ProcessAuditId] |
| 000481 | 16:11:07.126774 | 16:11:07.126802 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000482 | 16:11:07.126804 | 16:11:07.126843 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000483 | 16:11:07.126866 | 16:11:07.127189 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000484 | 16:11:07.127198 | 16:11:07.127199 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000485 | 16:11:07.127203 | 16:11:07.127230 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000486 | 16:11:07.127231 | 16:11:07.127268 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000487 | 16:11:07.127445 | 16:11:07.127495 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000488 | 16:11:07.127499 | 16:11:07.127523 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000489 | 16:11:07.127526 | 16:11:07.127543 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000490 | 16:11:07.127566 | 16:11:07.127633 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000491 | 16:11:07.129080 | 16:11:07.129140 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000492 | 16:11:07.129144 | 16:11:07.129169 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000493 | 16:11:07.129172 | 16:11:07.129190 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000494 | 16:11:07.129212 | 16:11:07.129267 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000495 | 16:11:07.131568 | 16:11:07.132382 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000496 | 16:11:07.176526 | 16:11:07.279289 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000497 | 16:11:07.279296 | 16:11:07.279349 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000498 | 16:11:07.279388 | 16:11:07.279915 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000499 | 16:11:07.279925 | 16:11:07.279927 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000500 | 16:11:07.279930 | 16:11:07.280424 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000501 | 16:11:07.280431 | 16:11:07.280512 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000502 | 16:11:07.280514 | 16:11:07.280547 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000503 | 16:11:07.577131 | 16:11:07.579846 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-859504640:] PrimaryToken ProcessAuditId] |
| 000504 | 16:11:07.579853 | 16:11:07.579881 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000505 | 16:11:07.579884 | 16:11:07.579923 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000506 | 16:11:07.579950 | 16:11:07.580265 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000507 | 16:11:07.580274 | 16:11:07.580277 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000508 | 16:11:07.580280 | 16:11:07.580308 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000509 | 16:11:07.580309 | 16:11:07.580346 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000510 | 16:11:07.580493 | 16:11:07.583625 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000511 | 16:11:07.583658 | 16:11:07.583700 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000512 | 16:11:07.583704 | 16:11:07.583724 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000513 | 16:11:07.583775 | 16:11:07.583848 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000514 | 16:11:07.585718 | 16:11:07.585811 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000515 | 16:11:07.585815 | 16:11:07.585841 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000516 | 16:11:07.585844 | 16:11:07.585863 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000517 | 16:11:07.585886 | 16:11:07.585946 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000518 | 16:11:07.587596 | 16:11:07.588110 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[933137616:] PrimaryToken ProcessAuditId] |
| 000519 | 16:11:07.588115 | 16:11:07.588143 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000520 | 16:11:07.588145 | 16:11:07.588189 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000521 | 16:11:07.588209 | 16:11:07.588525 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000522 | 16:11:07.588533 | 16:11:07.588535 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 000523 | 16:11:07.588538 | 16:11:07.588993 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000524 | 16:11:07.589000 | 16:11:07.589037 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000525 | 16:11:07.589039 | 16:11:07.589095 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000526 | 16:11:18.691585 | 16:11:18.693108 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848101376:] PrimaryToken ProcessAuditId] |
| 000527 | 16:11:18.693114 | 16:11:18.693156 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000528 | 16:11:18.693159 | 16:11:18.693197 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000529 | 16:11:18.693225 | 16:11:18.693612 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000530 | 16:11:18.693628 | 16:11:18.693634 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000531 | 16:11:18.693643 | 16:11:18.693668 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000532 | 16:11:18.693670 | 16:11:18.693704 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000533 | 16:11:18.694011 | 16:11:18.694062 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000534 | 16:11:18.694066 | 16:11:18.694088 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000535 | 16:11:18.694091 | 16:11:18.694106 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000536 | 16:11:18.694130 | 16:11:18.694185 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000537 | 16:11:18.695924 | 16:11:18.696039 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000538 | 16:11:18.696044 | 16:11:18.696067 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000539 | 16:11:18.696069 | 16:11:18.696088 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000540 | 16:11:18.696111 | 16:11:18.696171 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000541 | 16:11:22.270361 | 16:11:22.288246 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[786500164:] PrimaryToken ProcessAuditId] |
| 000542 | 16:11:22.288270 | 16:11:22.288303 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000543 | 16:11:22.288307 | 16:11:22.288344 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000544 | 16:11:22.288429 | 16:11:22.288998 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000545 | 16:11:22.289004 | 16:11:22.289031 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000546 | 16:11:22.289034 | 16:11:22.289086 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000547 | 16:11:22.289125 | 16:11:22.289782 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-192679296:] PrimaryToken ProcessAuditId] |
| 000548 | 16:11:22.289790 | 16:11:22.289792 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000549 | 16:11:22.289794 | 16:11:22.289821 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000550 | 16:11:22.289823 | 16:11:22.289856 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000551 | 16:11:22.289958 | 16:11:22.290578 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000552 | 16:11:22.290583 | 16:11:22.290609 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000553 | 16:11:22.290611 | 16:11:22.290645 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000554 | 16:11:22.290683 | 16:11:22.291028 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000555 | 16:11:22.291033 | 16:11:22.291057 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000556 | 16:11:22.291059 | 16:11:22.291103 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000557 | 16:11:22.291132 | 16:11:22.291607 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-192679296:] PrimaryToken ProcessAuditId] |
| 000558 | 16:11:22.291613 | 16:11:22.291614 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000559 | 16:11:22.291615 | 16:11:22.291639 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000560 | 16:11:22.291640 | 16:11:22.291668 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000561 | 16:11:22.291742 | 16:11:22.292094 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[246955795:] PrimaryToken ProcessAuditId] |
| 000562 | 16:11:22.292099 | 16:11:22.292123 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000563 | 16:11:22.292125 | 16:11:22.292164 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000564 | 16:11:22.292192 | 16:11:22.292585 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1000021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[21:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Access[100000:|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100000:|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100000:|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000565 | 16:11:22.292599 | 16:11:22.292601 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [218] | \nurl\MyServer\ | 9:FileNameInformation \nurl\MyServer\ | |
| 000566 | 16:11:22.292604 | 16:11:22.292608 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [16] | \nurl\MyServer\ | 5:FileFsAttributeInformation FAT Attributes[586:CASE_PRESERVED_NAMES|UNICODE_ON_DISK|SUPPORTS_REPARSE_POINTS|SUPPORTS_REMOTE_STORAGE|SUPPORTS_POSIX_UNLINK_RENAME] MaxName:255 | |
| 000567 | 16:11:22.292631 | 16:11:22.292656 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000568 | 16:11:22.292657 | 16:11:22.292695 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000569 | 16:11:22.292761 | 16:11:22.293095 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-870853248:] PrimaryToken ProcessAuditId] |
| 000570 | 16:11:22.293100 | 16:11:22.293122 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000571 | 16:11:22.293124 | 16:11:22.293160 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000572 | 16:11:22.293191 | 16:11:22.293545 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000573 | 16:11:22.293550 | 16:11:22.293573 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000574 | 16:11:22.293575 | 16:11:22.293608 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000575 | 16:11:22.293635 | 16:11:22.294031 | 0:CREATE[0] | C0000034:OBJECT_NAME_NOT_FOUND [5] | \nurl\MyServer\Backup of Test.wbk | 1:OPEN 5:DOES_NOT_EXIST Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[291283392:] PrimaryToken ProcessAuditId] |
| 000576 | 16:11:22.294061 | 16:11:22.294467 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000577 | 16:11:22.294472 | 16:11:22.294496 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000578 | 16:11:22.294499 | 16:11:22.294543 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000579 | 16:11:22.294576 | 16:11:22.294955 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000580 | 16:11:22.294960 | 16:11:22.294984 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000581 | 16:11:22.294986 | 16:11:22.295020 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000582 | 16:11:22.295047 | 16:11:22.295435 | 0:CREATE[0] | C0000034:OBJECT_NAME_NOT_FOUND [5] | \nurl\MyServer\Backup of Test.wbk | 1:OPEN 5:DOES_NOT_EXIST Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[291283392:] PrimaryToken ProcessAuditId] |
| 000583 | 16:11:22.383814 | 16:11:22.396037 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-1175925150:] PrimaryToken ProcessAuditId] |
| 000584 | 16:11:22.396048 | 16:11:22.396076 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000585 | 16:11:22.396079 | 16:11:22.396116 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000586 | 16:11:22.396156 | 16:11:22.396501 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000587 | 16:11:22.396506 | 16:11:22.396533 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000588 | 16:11:22.396535 | 16:11:22.396570 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000589 | 16:11:22.396591 | 16:11:22.396917 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188509760:] PrimaryToken ProcessAuditId] |
| 000590 | 16:11:22.396922 | 16:11:22.396924 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\ | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 000591 | 16:11:22.396925 | 16:11:22.396950 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000592 | 16:11:22.396951 | 16:11:22.397000 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000593 | 16:11:22.397045 | 16:11:22.397375 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000594 | 16:11:22.397379 | 16:11:22.397404 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000595 | 16:11:22.397406 | 16:11:22.397441 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000596 | 16:11:22.397466 | 16:11:22.397847 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000597 | 16:11:22.397852 | 16:11:22.397877 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000598 | 16:11:22.397879 | 16:11:22.397915 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000599 | 16:11:22.397935 | 16:11:22.399079 | 0:CREATE[0] | C0000034:OBJECT_NAME_NOT_FOUND [5] | \nurl\MyServer\FFB435A4.tmp | 1:OPEN 5:DOES_NOT_EXIST Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188509760:] PrimaryToken ProcessAuditId] |
| 000600 | 16:11:22.400195 | 16:11:22.400867 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000601 | 16:11:22.400879 | 16:11:22.400910 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000602 | 16:11:22.400913 | 16:11:22.400952 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000603 | 16:11:22.401721 | 16:11:22.402574 | 0:CREATE[0] | 0:SUCCESS [2] | \nurl\MyServer\FFB435A4.tmp | 5:OVERWRITE_IF 2:CREATED Opt[5000064:|SEQUENTIAL_ONLY|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Attr[2020:|ARCHIVE|NOT_CONTENT_INDEXED] Name[] Type[] | SecurityContext: FullOptions[64:|SEQUENTIAL_ONLY|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[17019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[17019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[17019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC] SubjectSecurityContext[ImpersonationLevel[245544844:] PrimaryToken ProcessAuditId] |
| 000604 | 16:11:22.402596 | 16:11:22.402600 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\FFB435A4.tmp | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000605 | 16:11:22.402614 | 16:11:22.402642 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000606 | 16:11:22.402644 | 16:11:22.402676 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000607 | 16:11:22.402708 | 16:11:22.403096 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000608 | 16:11:22.403102 | 16:11:22.403128 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000609 | 16:11:22.403131 | 16:11:22.403178 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000610 | 16:11:22.403206 | 16:11:22.403679 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\FFB435A4.tmp | 3:OPEN_IF 1:OPENED Opt[3000044:|SEQUENTIAL_ONLY|NON_DIRECTORY_FILE] Attr[2020:|ARCHIVE|NOT_CONTENT_INDEXED] Name[] Type[] | SecurityContext: FullOptions[44:|SEQUENTIAL_ONLY|NON_DIRECTORY_FILE] Access[17019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[17019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[17019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000611 | 16:11:22.403689 | 16:11:22.403693 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\FFB435A4.tmp | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000612 | 16:11:22.403699 | 16:11:22.404163 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer\FFB435A4.tmp | USER FSCTL[E4:FSCTL_QUERY_VOLUME_CONTAINER_STATE] | |
| 000613 | 16:11:22.404176 | 16:11:22.404180 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [16] | \nurl\MyServer\FFB435A4.tmp | 5:FileFsAttributeInformation FAT Attributes[586:CASE_PRESERVED_NAMES|UNICODE_ON_DISK|SUPPORTS_REPARSE_POINTS|SUPPORTS_REMOTE_STORAGE|SUPPORTS_POSIX_UNLINK_RENAME] MaxName:255 | |
| 000614 | 16:11:22.404187 | 16:11:22.404189 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\FFB435A4.tmp | 4:FileBasicInformation Cr[2018/07/17 09:11:22.402] A[2018/07/17 09:11:22.402] W[2018/07/17 09:11:22.402] Ch[2018/07/17 09:11:22.402] Attr[20:|ARCHIVE] | |
| 000615 | 16:11:22.404249 | 16:11:22.404252 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\FFB435A4.tmp | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000616 | 16:11:22.404257 | 16:11:22.404259 | 6:SET_INFORMATION[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp \nurl\MyServer\FFB435A4.tmp | 20:FileEndOfFileInformation 1,265,519 | |
| 000617 | 16:11:22.404263 | 16:11:22.404266 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\FFB435A4.tmp | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000618 | 16:11:22.404273 | 16:11:22.404275 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [10A] | \nurl\MyServer\FFB435A4.tmp | 49:FileNetworkPhysicalNameInformation \nurl\MyServer\FFB435A4.tmp | |
| 000619 | 16:11:22.404278 | 16:11:22.404280 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\FFB435A4.tmp | 4:FileFsDeviceInformation Type[7:DEVICE_DISK] Ch[10:REMOTE_DEVICE] | |
| 000620 | 16:11:22.404284 | 16:11:22.404688 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer\FFB435A4.tmp | 55:FileRemoteProtocolInformation | |
| WRITE to the temporary file. | |||||||
| 000621 | 16:11:22.406122 | 16:11:22.407744 | 4:WRITE[0] | 0:SUCCESS [40000] | \nurl\MyServer\FFB435A4.tmp | Pos[0:262144] | |
| 000622 | 16:11:22.406423 | 16:11:22.408246 | 4:WRITE[0] | 0:SUCCESS [40000] | \nurl\MyServer\FFB435A4.tmp | Pos[262,144:262144] | |
| 000623 | 16:11:22.406555 | 16:11:22.408604 | 4:WRITE[0] | 0:SUCCESS [40000] | \nurl\MyServer\FFB435A4.tmp | Pos[524,288:262144] | |
| 000624 | 16:11:22.406630 | 16:11:22.409006 | 4:WRITE[0] | 0:SUCCESS [40000] | \nurl\MyServer\FFB435A4.tmp | Pos[786,432:262144] | |
| 000625 | 16:11:22.406733 | 16:11:22.409279 | 4:WRITE[0] | 0:SUCCESS [34F6F] | \nurl\MyServer\FFB435A4.tmp | Pos[1,048,576:216943] | |
| 000626 | 16:11:22.409422 | 16:11:22.409426 | 6:SET_INFORMATION[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp \nurl\MyServer\FFB435A4.tmp | 4:FileBasicInformation W[2018/07/17 09:11:22.299] Ch[2018/07/17 09:11:22.377] | |
| 000627 | 16:11:22.409429 | 16:11:22.409766 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer\FFB435A4.tmp | 55:FileRemoteProtocolInformation | |
| 000628 | 16:11:22.409774 | 16:11:22.409841 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000629 | 16:11:22.409844 | 16:11:22.409909 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000630 | 16:11:22.409980 | 16:11:22.410053 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000631 | 16:11:22.410056 | 16:11:22.410090 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000632 | 16:11:22.410232 | 16:11:22.410775 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[786500164:] PrimaryToken ProcessAuditId] |
| 000633 | 16:11:22.410782 | 16:11:22.410812 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000634 | 16:11:22.410814 | 16:11:22.410855 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000635 | 16:11:22.410891 | 16:11:22.411309 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000636 | 16:11:22.411331 | 16:11:22.411361 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000637 | 16:11:22.411364 | 16:11:22.411425 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000638 | 16:11:22.411455 | 16:11:22.412074 | 0:CREATE[0] | C0000034:OBJECT_NAME_NOT_FOUND [5] | \nurl\MyServer\68A1155.tmp | 1:OPEN 5:DOES_NOT_EXIST Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[291283201:] PrimaryToken ProcessAuditId] |
| 000639 | 16:11:22.412136 | 16:11:22.412644 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[246955795:] PrimaryToken ProcessAuditId] |
| 000640 | 16:11:22.412653 | 16:11:22.412763 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000641 | 16:11:22.412766 | 16:11:22.412828 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000642 | 16:11:22.412861 | 16:11:22.413883 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[20000:|READ_CONTROL] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[20000:|READ_CONTROL] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[20000:|READ_CONTROL] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000643 | 16:11:22.413972 | 16:11:22.413986 | 20:QUERY_SECURITY[0] | 0:SUCCESS [200] | \nurl\MyServer\Test.txt | Info[7:OWNER_SECURITY_INFORMATION|GROUP_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION][R:01 C:0004 O:0 G:0 S:0 D:0] | |
| 000644 | 16:11:22.414001 | 16:11:22.414357 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000645 | 16:11:22.414363 | 16:11:22.414415 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000646 | 16:11:22.414483 | 16:11:22.415073 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000647 | 16:11:22.415086 | 16:11:22.415125 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000648 | 16:11:22.415128 | 16:11:22.415172 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000649 | 16:11:22.415218 | 16:11:22.443917 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\FFB435A4.tmp | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[C0000:|WRITE_DAC|WRITE_OWNER] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[C0000:|WRITE_DAC|WRITE_OWNER] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[C0000:|WRITE_DAC|WRITE_OWNER] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000650 | 16:11:22.443995 | 16:11:22.444031 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000651 | 16:11:22.444033 | 16:11:22.444067 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000652 | 16:11:22.444141 | 16:11:22.444515 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000653 | 16:11:22.444521 | 16:11:22.444548 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000654 | 16:11:22.444551 | 16:11:22.444589 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000655 | 16:11:22.444643 | 16:11:22.445142 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Access[113008B:|READ_DATA|WRITE_DATA|READ_EA|READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNC|ACCESS_SYS_SEC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[113008B:|READ_DATA|WRITE_DATA|READ_EA|READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNC|ACCESS_SYS_SEC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[113008B:|READ_DATA|WRITE_DATA|READ_EA|READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNC|ACCESS_SYS_SEC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000656 | 16:11:22.445151 | 16:11:22.445179 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000657 | 16:11:22.445181 | 16:11:22.445213 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000658 | 16:11:22.445238 | 16:11:22.445585 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000659 | 16:11:22.445589 | 16:11:22.445629 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000660 | 16:11:22.445632 | 16:11:22.445673 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000661 | 16:11:22.445698 | 16:11:22.446189 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Access[13008B:|READ_DATA|WRITE_DATA|READ_EA|READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[13008B:|READ_DATA|WRITE_DATA|READ_EA|READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[13008B:|READ_DATA|WRITE_DATA|READ_EA|READ_ATTRIBUTES|DELETE|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000662 | 16:11:22.446221 | 16:11:22.446570 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000663 | 16:11:22.446575 | 16:11:22.446602 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000664 | 16:11:22.446604 | 16:11:22.446679 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000665 | 16:11:22.446704 | 16:11:22.447208 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\FFB435A4.tmp | 1:OPEN 1:OPENED Opt[1000060:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Name[] Type[] | SecurityContext: FullOptions[60:|SYNCHRONOUS_IO_NONALERT|NON_DIRECTORY_FILE] Access[1F019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[1F019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[1F019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|DELETE|READ_CONTROL|WRITE_DAC|WRITE_OWNER|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000666 | 16:11:22.447221 | 16:11:22.447224 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000667 | 16:11:22.447226 | 16:11:22.447228 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\FFB435A4.tmp | 4:FileBasicInformation Cr[2018/07/17 09:11:22.402] A[2018/07/17 09:11:22.402] W[2018/07/17 09:11:22.402] Ch[2018/07/17 09:11:22.402] Attr[20:|ARCHIVE] | |
| 000668 | 16:11:22.447229 | 16:11:22.447231 | 6:SET_INFORMATION[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp \nurl\MyServer\FFB435A4.tmp | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] Attr[20:|ARCHIVE] | |
| 000669 | 16:11:22.447233 | 16:11:22.447238 | 10:QUERY_VOLUME_INFORMATION[0] | 0:SUCCESS [16] | \nurl\MyServer\FFB435A4.tmp | 5:FileFsAttributeInformation FAT Attributes[586:CASE_PRESERVED_NAMES|UNICODE_ON_DISK|SUPPORTS_REPARSE_POINTS|SUPPORTS_REMOTE_STORAGE|SUPPORTS_POSIX_UNLINK_RENAME] MaxName:255 | |
| 000670 | 16:11:22.447248 | 16:11:22.447250 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [1000] | \nurl\MyServer\Test.txt | 22:FileStreamInformation | |
| 000671 | 16:11:22.447253 | 16:11:22.447684 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer\FFB435A4.tmp | USER FSCTL[28:FSCTL_DELETE_OBJECT_ID] | |
| 000672 | 16:11:22.448743 | 16:11:22.449296 | 13:FILE_SYSTEM_CONTROL[4] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | KRNL FSCTL[27:FSCTL_GET_OBJECT_ID] | |
| 000673 | 16:11:22.449337 | 16:11:22.449341 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [1F4] | \nurl\MyServer\Test.txt | 9:FileNameInformation \nurl\MyServer\Test.txt | |
| 000674 | 16:11:22.449402 | 16:11:22.449404 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000675 | 16:11:22.449432 | 16:11:22.460301 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[785055744:] PrimaryToken ProcessAuditId] |
| THIS IS REPORTED AS NAME NOT FOUND! | |||||||
| 000676 | 16:11:22.460312 | 16:11:22.460363 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000677 | 16:11:22.460367 | 16:11:22.460410 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000678 | 16:11:22.460450 | 16:11:22.461611 | 0:CREATE[0] | C0000034:OBJECT_NAME_NOT_FOUND [5] | \nurl\MyServer\68A1155.tmp | 1:OPEN 5:DOES_NOT_EXIST Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100002:|WRITE_DATA|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100002:|WRITE_DATA|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100002:|WRITE_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-192428080:] PrimaryToken ProcessAuditId] |
| 000679 | 16:11:22.461658 | 16:11:22.461745 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000680 | 16:11:22.461748 | 16:11:22.461792 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000681 | 16:11:22.461801 | 16:11:22.462420 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [8] | \nurl\MyServer\FFB435A4.tmp | USER FSCTL[3B:FSCTL_WRITE_USN_CLOSE_RECORD] | |
| 000682 | 16:11:22.462463 | 16:11:22.462593 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000683 | 16:11:22.462596 | 16:11:22.462697 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000684 | 16:11:22.462793 | 16:11:22.463736 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000685 | 16:11:22.463784 | 16:11:22.463844 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000686 | 16:11:22.463851 | 16:11:22.463914 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000687 | 16:11:22.464045 | 16:11:22.465783 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\FFB435A4.tmp | 1:OPEN 1:OPENED Opt[1200040:|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200040:|NON_DIRECTORY_FILE|OPEN_REPARSE_POINT] Access[10080:|READ_ATTRIBUTES|DELETE] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[10080:|READ_ATTRIBUTES|DELETE] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[10080:|READ_ATTRIBUTES|DELETE] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000688 | 16:11:22.465887 | 16:11:22.465893 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [8] | \nurl\MyServer\FFB435A4.tmp | 35:FileAttributeTagInformation Attr[20:|ARCHIVE] Reparse[0] | |
| SAVE HAS FAILED, Word is deleting the temporary file. | |||||||
| 000689 | 16:11:22.465898 | 16:11:22.465901 | 6:SET_INFORMATION[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp \nurl\MyServer\FFB435A4.tmp | 13:FileDispositionInformation DELETE | |
| 000690 | 16:11:22.465906 | 16:11:22.465954 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000691 | 16:11:22.465957 | 16:11:22.465998 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\FFB435A4.tmp | ||
| 000692 | 16:25:16.940978 | 16:25:16.993323 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245695745:] PrimaryToken ProcessAuditId] |
| 000693 | 16:25:16.993362 | 16:25:16.993415 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000694 | 16:25:16.993418 | 16:25:16.993456 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000695 | 16:25:16.995957 | 16:25:17.053088 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[6800:] PrimaryToken ProcessAuditId] |
| 000696 | 16:25:17.053108 | 16:25:17.053109 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000697 | 16:25:17.053114 | 16:25:17.053116 | 12:DIRECTORY_CONTROL[2] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer | 2:NOTIFY | |
| 000698 | 16:25:17.057430 | 16:25:17.065479 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000699 | 16:25:17.065489 | 16:25:17.065517 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000700 | 16:25:17.065520 | 16:25:17.065556 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000701 | 16:25:17.065585 | 16:25:17.065974 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[-196428608:] PrimaryToken ProcessAuditId] |
| 000702 | 16:25:17.065986 | 16:25:17.065987 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000703 | 16:25:17.065991 | 16:25:17.065993 | 12:DIRECTORY_CONTROL[2] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer | 2:NOTIFY | |
| 000704 | 16:25:32.541335 | 16:25:32.561021 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000705 | 16:25:32.561025 | 16:25:32.561075 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000706 | 16:25:32.561084 | 16:25:32.561106 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000707 | 16:25:32.561107 | 16:25:32.561141 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000708 | 16:25:44.813045 | 16:25:44.818340 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000709 | 16:25:44.818351 | 16:25:44.818381 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000710 | 16:25:44.818384 | 16:25:44.818420 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000711 | 16:25:44.818472 | 16:25:44.818794 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000712 | 16:25:44.818798 | 16:25:44.818821 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000713 | 16:25:44.818823 | 16:25:44.818856 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000714 | 16:25:44.818884 | 16:25:44.819476 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000715 | 16:25:44.819482 | 16:25:44.819484 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000716 | 16:25:44.819485 | 16:25:44.819512 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000717 | 16:25:44.819513 | 16:25:44.819542 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000718 | 16:25:44.819587 | 16:25:44.819914 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000719 | 16:25:44.819918 | 16:25:44.819941 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000720 | 16:25:44.819943 | 16:25:44.819977 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000721 | 16:25:44.820008 | 16:25:44.820345 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000722 | 16:25:44.820350 | 16:25:44.820373 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000723 | 16:25:44.820375 | 16:25:44.820409 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000724 | 16:25:44.820435 | 16:25:44.820871 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000725 | 16:25:44.820877 | 16:25:44.820878 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000726 | 16:25:44.820879 | 16:25:44.820903 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000727 | 16:25:44.820905 | 16:25:44.820934 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000728 | 16:25:44.837923 | 16:25:44.844873 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-846200832:] PrimaryToken ProcessAuditId] |
| 000729 | 16:25:44.844959 | 16:25:44.845003 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000730 | 16:25:44.845007 | 16:25:44.845087 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000731 | 16:25:44.845132 | 16:25:44.845626 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000732 | 16:25:44.845652 | 16:25:44.845654 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000733 | 16:25:44.845662 | 16:25:44.845690 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000734 | 16:25:44.845692 | 16:25:44.845739 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000735 | 16:25:44.846118 | 16:25:44.846226 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000736 | 16:25:44.846233 | 16:25:44.846262 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000737 | 16:25:44.846265 | 16:25:44.846805 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000738 | 16:25:44.846874 | 16:25:44.847036 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000739 | 16:25:47.401738 | 16:25:47.405272 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-857538560:] PrimaryToken ProcessAuditId] |
| 000740 | 16:25:47.405283 | 16:25:47.405319 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000741 | 16:25:47.405322 | 16:25:47.405362 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000742 | 16:25:47.405402 | 16:25:47.405883 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000743 | 16:25:47.405914 | 16:25:47.405916 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000744 | 16:25:47.405925 | 16:25:47.405960 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000745 | 16:25:47.405962 | 16:25:47.406003 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000746 | 16:25:47.406347 | 16:25:47.406433 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000747 | 16:25:47.406440 | 16:25:47.406578 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000748 | 16:25:47.406584 | 16:25:47.406648 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000749 | 16:25:47.406693 | 16:25:47.406784 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000750 | 16:25:47.990896 | 16:25:47.997138 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000751 | 16:25:47.996244 | 16:25:47.997257 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000752 | 16:25:47.997155 | 16:25:47.997406 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000753 | 16:25:47.997265 | 16:25:47.997473 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000754 | 16:25:47.997419 | 16:25:47.997520 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000755 | 16:25:47.997480 | 16:25:47.997666 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000756 | 16:25:47.997612 | 16:25:47.997861 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000757 | 16:25:47.997720 | 16:25:48.003559 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000758 | 16:25:50.373441 | 16:25:50.390258 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000759 | 16:25:50.390282 | 16:25:50.390357 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000760 | 16:25:50.390365 | 16:25:50.390534 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000761 | 16:25:50.390694 | 16:25:50.392678 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000762 | 16:25:50.392712 | 16:25:50.392818 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000763 | 16:25:50.392835 | 16:25:50.393003 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000764 | 16:25:50.393223 | 16:25:50.394427 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000765 | 16:25:50.394530 | 16:25:50.394534 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\ | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000766 | 16:25:50.394537 | 16:25:50.394596 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000767 | 16:25:50.394599 | 16:25:50.394673 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000768 | 16:25:50.397511 | 16:25:50.404749 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000769 | 16:25:50.404765 | 16:25:50.404821 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000770 | 16:25:50.404825 | 16:25:50.404909 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000771 | 16:25:50.405122 | 16:25:50.407084 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000772 | 16:25:50.407150 | 16:25:50.407250 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000773 | 16:25:50.407262 | 16:25:50.407390 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000774 | 16:25:50.407461 | 16:25:50.408052 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000775 | 16:25:50.408065 | 16:25:50.408066 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\ | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000776 | 16:25:50.408068 | 16:25:50.408102 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000777 | 16:25:50.408105 | 16:25:50.408153 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000778 | 16:25:50.424098 | 16:25:50.436923 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000779 | 16:25:50.436846 | 16:25:50.436971 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000780 | 16:25:50.436930 | 16:25:50.436996 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000781 | 16:25:50.436974 | 16:25:50.437021 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000782 | 16:25:50.437000 | 16:25:50.437038 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000783 | 16:25:50.437023 | 16:25:50.437090 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000784 | 16:25:50.437070 | 16:25:50.437151 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000785 | 16:25:50.437109 | 16:25:50.437205 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000786 | 16:25:50.437163 | 16:25:50.437164 | 6:SET_INFORMATION[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\PIPE\wkssvc \nurl\PIPE\wkssvc | 23:FilePipeInformation | |
| 000787 | 16:25:50.437168 | 16:25:50.437239 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | ||
| 000788 | 16:25:50.437213 | 16:25:50.437215 | 6:SET_INFORMATION[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\PIPE\wkssvc \nurl\PIPE\wkssvc | 23:FilePipeInformation | |
| 000789 | 16:25:50.437217 | 16:25:50.437261 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | ||
| 000790 | 16:25:50.437241 | 16:25:50.437277 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | ||
| 000791 | 16:25:50.437262 | 16:25:50.440670 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\wkssvc | ||
| 000792 | 16:25:52.551066 | 00:00:00.000000 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245695745:] PrimaryToken ProcessAuditId] |
| 000793 | 16:25:52.567905 | 16:25:52.567938 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000794 | 16:25:52.567941 | 16:25:52.567977 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000795 | 16:25:52.568006 | 16:25:52.568400 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[6816:] PrimaryToken ProcessAuditId] |
| 000796 | 16:25:52.568413 | 16:25:52.568414 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000797 | 16:25:52.568418 | 16:25:52.568421 | 12:DIRECTORY_CONTROL[2] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer | 2:NOTIFY | |
| 000798 | 16:25:52.568493 | 16:25:52.568814 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 000799 | 16:25:52.568818 | 16:25:52.568841 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000800 | 16:25:52.568843 | 16:25:52.568876 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000801 | 16:25:52.568894 | 16:25:52.569193 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000802 | 16:25:52.569200 | 16:25:52.569201 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000803 | 16:25:52.569203 | 16:25:52.569205 | 12:DIRECTORY_CONTROL[2] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer | 2:NOTIFY | |
| 000804 | 16:25:54.116577 | 16:25:54.131463 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000805 | 16:25:54.131468 | 16:25:54.131517 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000806 | 16:25:54.131529 | 16:25:54.131550 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000807 | 16:25:54.131551 | 16:25:54.131583 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000808 | 16:25:57.933111 | 16:25:57.933941 | 14:DEVICE_CONTROL[0] | 0:SUCCESS [4] | IOCTL[140193] Device[14:DEVICE_NETWORK_FILE_SYSTEM] Cmd:100 Access 0 Method 3:NEITHER Path[\nurl\IPC$] Accepted[10:\nurl] | ||
| 000809 | 16:25:57.933963 | 16:25:57.934496 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\IPC$ | 3:OPEN_IF 0:SUPERSEDED Opt[30000A0:|SYNCHRONOUS_IO_NONALERT|CREATE_TREE_CONNECTION] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[A0:|SYNCHRONOUS_IO_NONALERT|CREATE_TREE_CONNECTION] Access[100000:|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[100000:|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100000:|SYNC] SubjectSecurityContext[ImpersonationLevel[2:Impersonation] PrimaryToken ProcessAuditId] |
| 000810 | 16:25:57.934510 | 16:25:57.935097 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [1000] | \nurl\IPC$ | USER FSCTL[65:FSCTL_SET_ZERO_ON_DEALLOCATION] | |
| 000811 | 16:25:57.935105 | 16:25:57.935374 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [0] | \nurl\IPC$ | USER FSCTL[6B:FSCTL_CSC_INTERNAL] | |
| 000812 | 16:25:57.935395 | 16:25:57.935433 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\IPC$ | ||
| 000813 | 16:25:57.935435 | 16:25:57.935454 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\IPC$ | ||
| 000814 | 16:25:57.935534 | 16:25:57.936099 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000815 | 16:25:57.936105 | 16:25:57.936151 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000816 | 16:25:57.936154 | 16:25:57.936224 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000817 | 16:25:57.936248 | 16:25:57.936934 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188524288:] PrimaryToken ProcessAuditId] |
| 000818 | 16:25:57.936941 | 16:25:57.936943 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000819 | 16:25:57.936944 | 16:25:57.936984 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000820 | 16:25:57.936986 | 16:25:57.937016 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000821 | 16:25:57.937193 | 16:25:57.943566 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000822 | 16:25:57.943580 | 16:25:57.943650 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000823 | 16:25:57.943654 | 16:25:57.943693 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000824 | 16:25:57.943745 | 16:25:57.944246 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000825 | 16:25:57.944253 | 16:25:57.944294 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000826 | 16:25:57.944297 | 16:25:57.944333 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000827 | 16:25:57.944372 | 16:25:57.944739 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-188524288:] PrimaryToken ProcessAuditId] |
| 000828 | 16:25:57.944746 | 16:25:57.944767 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000829 | 16:25:57.944768 | 16:25:57.944834 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000830 | 16:25:57.944836 | 16:25:57.944873 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000831 | 16:25:57.959321 | 16:25:57.988052 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-846004224:] PrimaryToken ProcessAuditId] |
| 000832 | 16:25:57.967869 | 16:25:57.988409 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-845807616:] PrimaryToken ProcessAuditId] |
| 000833 | 16:25:57.988065 | 16:25:57.988431 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000834 | 16:25:57.988434 | 16:25:57.988473 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000835 | 16:25:57.988561 | 16:25:57.988989 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000836 | 16:25:57.989029 | 16:25:57.989031 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000837 | 16:25:57.989040 | 16:25:57.989068 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000838 | 16:25:57.989069 | 16:25:57.989106 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000839 | 16:25:57.989694 | 16:25:57.989781 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000840 | 16:25:57.989788 | 16:25:57.989815 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000841 | 16:25:57.989819 | 16:25:57.989861 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000842 | 16:25:57.989906 | 16:25:57.989971 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000843 | 16:25:57.994876 | 16:25:57.995384 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000844 | 16:25:57.995439 | 16:25:57.995485 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000845 | 16:25:57.995489 | 16:25:57.995635 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000846 | 16:25:57.995696 | 16:25:57.995802 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000847 | 16:25:57.998323 | 16:25:57.998786 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-1175925150:] PrimaryToken ProcessAuditId] |
| 000848 | 16:25:57.998792 | 16:25:57.998823 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000849 | 16:25:57.998826 | 16:25:57.998864 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000850 | 16:25:57.998890 | 16:25:57.999228 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000851 | 16:25:57.999233 | 16:25:57.999258 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000852 | 16:25:57.999260 | 16:25:57.999297 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000853 | 16:25:57.999317 | 16:25:57.999862 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-243551760:] PrimaryToken ProcessAuditId] |
| 000854 | 16:25:57.999869 | 16:25:57.999870 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000855 | 16:25:57.999871 | 16:25:57.999897 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000856 | 16:25:57.999899 | 16:25:57.999930 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000857 | 16:25:58.001984 | 16:25:58.002335 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000858 | 16:25:58.002340 | 16:25:58.002365 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000859 | 16:25:58.002367 | 16:25:58.002404 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000860 | 16:25:58.002428 | 16:25:58.002763 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000861 | 16:25:58.002768 | 16:25:58.002793 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000862 | 16:25:58.002796 | 16:25:58.002831 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000863 | 16:25:58.002851 | 16:25:58.003288 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[947259344:] PrimaryToken ProcessAuditId] |
| 000864 | 16:25:58.003293 | 16:25:58.003295 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000865 | 16:25:58.003296 | 16:25:58.003322 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000866 | 16:25:58.003324 | 16:25:58.003355 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000867 | 16:25:58.004454 | 16:25:58.004494 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000868 | 16:25:58.004497 | 16:25:58.004577 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000869 | 16:25:58.004634 | 16:25:58.004970 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000870 | 16:25:58.004983 | 16:25:58.004985 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 000871 | 16:25:58.004990 | 16:25:58.005016 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000872 | 16:25:58.005018 | 16:25:58.005062 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000873 | 16:25:58.005292 | 16:25:58.005341 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000874 | 16:25:58.005346 | 16:25:58.005369 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000875 | 16:25:58.005371 | 16:25:58.005388 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000876 | 16:25:58.005412 | 16:25:58.005464 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000877 | 16:25:58.010221 | 16:25:58.010328 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000878 | 16:25:58.010336 | 16:25:58.010366 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000879 | 16:25:58.010369 | 16:25:58.010413 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 000880 | 16:25:58.010518 | 16:25:58.010608 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000881 | 16:25:58.031134 | 00:00:00.000000 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000882 | 16:25:58.070782 | 16:25:58.070807 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000883 | 16:25:58.070810 | 16:25:58.070847 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000884 | 16:25:58.070929 | 16:25:58.071465 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000885 | 16:25:58.071471 | 16:25:58.071573 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000886 | 16:25:58.071576 | 16:25:58.071610 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000887 | 16:25:58.071642 | 16:25:58.072101 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[947259344:] PrimaryToken ProcessAuditId] |
| 000888 | 16:25:58.072118 | 16:25:58.072120 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\ | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 000889 | 16:25:58.072122 | 16:25:58.072165 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000890 | 16:25:58.072167 | 16:25:58.072204 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000891 | 16:25:58.087232 | 16:25:58.091909 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245490980:] PrimaryToken ProcessAuditId] |
| 000892 | 16:25:58.091920 | 16:25:58.091948 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000893 | 16:25:58.091951 | 16:25:58.091987 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000894 | 16:25:58.092021 | 16:25:58.092380 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000895 | 16:25:58.092386 | 16:25:58.092410 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000896 | 16:25:58.092412 | 16:25:58.092445 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000897 | 16:25:58.092465 | 16:25:58.092949 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-239568112:] PrimaryToken ProcessAuditId] |
| 000898 | 16:25:58.092955 | 16:25:58.092956 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000899 | 16:25:58.092958 | 16:25:58.092980 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000900 | 16:25:58.092982 | 16:25:58.093010 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000901 | 16:25:58.093033 | 16:25:58.093536 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[250060812:] PrimaryToken ProcessAuditId] |
| 000902 | 16:25:58.093541 | 16:25:58.093580 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000903 | 16:25:58.093583 | 16:25:58.093618 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000904 | 16:25:58.093642 | 16:25:58.094005 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[3:Delegation] PrimaryToken ProcessAuditId] |
| 000905 | 16:25:58.094009 | 16:25:58.094033 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000906 | 16:25:58.094035 | 16:25:58.094069 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000907 | 16:25:58.094088 | 16:25:58.094558 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200000:|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200000:|OPEN_REPARSE_POINT] Access[80:|READ_ATTRIBUTES] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[80:|READ_ATTRIBUTES] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[80:|READ_ATTRIBUTES] SubjectSecurityContext[ImpersonationLevel[-239568112:] PrimaryToken ProcessAuditId] |
| 000908 | 16:25:58.094564 | 16:25:58.094565 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer\Test.txt | 4:FileBasicInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] Attr[20:|ARCHIVE] | |
| 000909 | 16:25:58.094567 | 16:25:58.094593 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000910 | 16:25:58.094595 | 16:25:58.094624 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000911 | 16:25:58.094645 | 16:25:58.094974 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[246955795:] PrimaryToken ProcessAuditId] |
| 000912 | 16:25:58.094979 | 16:25:58.095003 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000913 | 16:25:58.095006 | 16:25:58.095045 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000914 | 16:25:58.095066 | 16:25:58.095432 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1000021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[21:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100001:|READ_DATA|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000915 | 16:25:58.095441 | 16:25:58.095578 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [70] | \nurl\MyServer\ | 1:QUERY Test.txt | |
| 000916 | 16:25:58.095582 | 16:25:58.095610 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000917 | 16:25:58.095612 | 16:25:58.095647 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000918 | 16:25:58.117605 | 16:25:58.124322 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-845938688:] PrimaryToken ProcessAuditId] |
| 000919 | 16:25:58.124331 | 16:25:58.124359 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000920 | 16:25:58.124375 | 16:25:58.124455 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000921 | 16:25:58.124492 | 16:25:58.124838 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000922 | 16:25:58.124849 | 16:25:58.124852 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000923 | 16:25:58.124856 | 16:25:58.124882 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000924 | 16:25:58.124883 | 16:25:58.124918 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000925 | 16:25:58.125089 | 16:25:58.125137 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000926 | 16:25:58.125141 | 16:25:58.125166 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000927 | 16:25:58.125168 | 16:25:58.125184 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000928 | 16:25:58.125208 | 16:25:58.125262 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000929 | 16:25:58.126799 | 16:25:58.126854 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000930 | 16:25:58.126859 | 16:25:58.126883 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000931 | 16:25:58.126885 | 16:25:58.126902 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000932 | 16:25:58.126923 | 16:25:58.126974 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000933 | 16:26:01.527736 | 16:26:01.528615 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245698152:] PrimaryToken ProcessAuditId] |
| 000934 | 16:26:01.528624 | 16:26:01.528651 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000935 | 16:26:01.528654 | 16:26:01.528698 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000936 | 16:26:01.528732 | 16:26:01.529213 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[-196428608:] PrimaryToken ProcessAuditId] |
| 000937 | 16:26:01.529223 | 16:26:01.529224 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000938 | 16:26:01.529388 | 16:26:01.529884 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000939 | 16:26:01.529891 | 16:26:01.542441 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000940 | 16:26:01.542448 | 16:26:01.542492 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000941 | 16:26:01.576166 | 00:00:00.000000 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000942 | 16:26:01.577656 | 16:26:01.577702 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000943 | 16:26:01.577704 | 16:26:01.577741 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000944 | 16:26:01.577789 | 16:26:01.578102 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000945 | 16:26:01.578111 | 16:26:01.578575 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer | 55:FileRemoteProtocolInformation | |
| 000946 | 16:26:01.578580 | 16:26:01.578778 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [84] | \nurl\MyServer | 1:QUERY Test.txt | |
| 000947 | 16:26:01.578798 | 16:26:01.578829 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000948 | 16:26:01.578830 | 16:26:01.578868 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000949 | 16:26:01.581111 | 16:26:01.581676 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-871104512:] PrimaryToken ProcessAuditId] |
| 000950 | 16:26:01.581681 | 16:26:01.581706 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000951 | 16:26:01.581709 | 16:26:01.581744 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000952 | 16:26:01.581769 | 16:26:01.582075 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000953 | 16:26:01.582083 | 16:26:01.582085 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000954 | 16:26:01.582088 | 16:26:01.582114 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000955 | 16:26:01.582116 | 16:26:01.582149 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000956 | 16:26:01.582309 | 16:26:01.582351 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000957 | 16:26:01.582354 | 16:26:01.582409 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000958 | 16:26:01.582413 | 16:26:01.582443 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000959 | 16:26:01.582468 | 16:26:01.582521 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000960 | 16:26:01.585361 | 16:26:01.585564 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000961 | 16:26:01.585576 | 16:26:01.585609 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000962 | 16:26:01.585613 | 16:26:01.585632 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000963 | 16:26:01.585681 | 16:26:01.585751 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000964 | 16:26:01.588530 | 16:26:01.588955 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 000965 | 16:26:01.588960 | 16:26:01.588984 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000966 | 16:26:01.588986 | 16:26:01.589021 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000967 | 16:26:01.589041 | 16:26:01.589824 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000968 | 16:26:01.589833 | 16:26:01.589834 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 000969 | 16:26:01.589836 | 16:26:01.590246 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000970 | 16:26:01.590270 | 16:26:01.590322 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000971 | 16:26:01.590324 | 16:26:01.590374 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 000972 | 16:26:01.616443 | 16:26:01.646618 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-847446016:] PrimaryToken ProcessAuditId] |
| 000973 | 16:26:01.647227 | 16:26:01.647709 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000974 | 16:26:01.647715 | 16:26:01.647763 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000975 | 16:26:01.647806 | 16:26:01.648215 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000976 | 16:26:01.648225 | 16:26:01.648227 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 000977 | 16:26:01.648230 | 16:26:01.648257 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000978 | 16:26:01.648258 | 16:26:01.648293 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 000979 | 16:26:01.648447 | 16:26:01.648494 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000980 | 16:26:01.648498 | 16:26:01.648522 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000981 | 16:26:01.648524 | 16:26:01.648541 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000982 | 16:26:01.648605 | 16:26:01.648682 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000983 | 16:26:01.650156 | 16:26:01.650212 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 000984 | 16:26:01.650216 | 16:26:01.650242 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000985 | 16:26:01.650245 | 16:26:01.650276 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 000986 | 16:26:01.650298 | 16:26:01.650351 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 000987 | 16:26:01.651987 | 16:26:01.652350 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 000988 | 16:26:01.652357 | 16:26:01.652382 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000989 | 16:26:01.652385 | 16:26:01.652421 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 000990 | 16:26:01.652441 | 16:26:01.652782 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 000991 | 16:26:01.652791 | 16:26:01.652792 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 000992 | 16:26:01.652794 | 16:26:01.653269 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 000993 | 16:26:01.653276 | 16:26:01.653309 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000994 | 16:26:01.653311 | 16:26:01.653349 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 000995 | 16:26:01.655107 | 16:26:01.656937 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-849346560:] PrimaryToken ProcessAuditId] |
| 000996 | 16:26:01.657006 | 16:26:01.657132 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000997 | 16:26:01.657137 | 16:26:01.657215 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 000998 | 16:26:01.657273 | 16:26:01.658408 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 000999 | 16:26:01.658431 | 16:26:01.658434 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 001000 | 16:26:01.658438 | 16:26:01.658494 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001001 | 16:26:01.658496 | 16:26:01.659409 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001002 | 16:26:01.659782 | 16:26:01.659962 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001003 | 16:26:01.659972 | 16:26:01.660009 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001004 | 16:26:01.660015 | 16:26:01.660040 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001005 | 16:26:01.660089 | 16:26:01.660203 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001006 | 16:26:01.662389 | 16:26:01.662565 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001007 | 16:26:01.662675 | 16:26:01.662795 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001008 | 16:26:01.662803 | 16:26:01.662836 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001009 | 16:26:01.662931 | 16:26:01.663024 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001010 | 16:26:01.666146 | 16:26:01.666800 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 001011 | 16:26:01.668154 | 16:26:01.687629 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001012 | 16:26:01.687639 | 16:26:01.687762 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001013 | 16:26:01.687839 | 16:26:01.688327 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 001014 | 16:26:01.688340 | 16:26:01.688342 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 001015 | 16:26:01.688345 | 16:26:01.688858 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 001016 | 16:26:01.688872 | 16:26:01.688928 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001017 | 16:26:01.688930 | 16:26:01.688990 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001018 | 16:26:01.691916 | 16:26:01.692819 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848494592:] PrimaryToken ProcessAuditId] |
| 001019 | 16:26:01.692837 | 16:26:01.692875 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001020 | 16:26:01.692879 | 16:26:01.692927 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001021 | 16:26:01.693006 | 16:26:01.693425 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001022 | 16:26:01.693440 | 16:26:01.693443 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \nurl\MyServer | 49:FileNetworkPhysicalNameInformation \nurl\MyServer | |
| 001023 | 16:26:01.693450 | 16:26:01.693483 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001024 | 16:26:01.693485 | 16:26:01.693528 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001025 | 16:26:01.693881 | 16:26:01.693943 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001026 | 16:26:01.693947 | 16:26:01.693976 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 001027 | 16:26:01.693979 | 16:26:01.694021 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 001028 | 16:26:01.694054 | 16:26:01.694133 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001029 | 16:26:01.695720 | 16:26:01.695786 | 0:CREATE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001030 | 16:26:01.695791 | 16:26:01.695816 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 001031 | 16:26:01.695819 | 16:26:01.695837 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\PIPE\ | ||
| 001032 | 16:26:01.695861 | 16:26:01.695919 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \nurl\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001033 | 16:26:01.791486 | 16:26:01.798780 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848494592:] PrimaryToken ProcessAuditId] |
| 001034 | 16:26:01.798794 | 16:26:01.798825 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001035 | 16:26:01.798828 | 16:26:01.798866 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001036 | 16:26:01.798908 | 16:26:01.799481 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001037 | 16:26:01.799502 | 16:26:01.799505 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 001038 | 16:26:01.799509 | 16:26:01.799544 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001039 | 16:26:01.799546 | 16:26:01.799592 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001040 | 16:26:01.799806 | 16:26:01.799885 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001041 | 16:26:01.799893 | 16:26:01.799923 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001042 | 16:26:01.799927 | 16:26:01.799990 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001043 | 16:26:01.800044 | 16:26:01.800159 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001044 | 16:26:01.801671 | 16:26:01.801732 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001045 | 16:26:01.801736 | 16:26:01.801761 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001046 | 16:26:01.801763 | 16:26:01.801780 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001047 | 16:26:01.801802 | 16:26:01.801864 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001048 | 16:26:01.803547 | 16:26:01.803950 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 001049 | 16:26:01.803954 | 16:26:01.804024 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001050 | 16:26:01.804027 | 16:26:01.804066 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001051 | 16:26:01.804090 | 16:26:01.804569 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 001052 | 16:26:01.804577 | 16:26:01.804579 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 001053 | 16:26:01.804581 | 16:26:01.805066 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 001054 | 16:26:01.805073 | 16:26:01.805105 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 001055 | 16:26:01.805107 | 16:26:01.805139 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 001056 | 16:26:01.832567 | 16:26:01.839769 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-848494592:] PrimaryToken ProcessAuditId] |
| 001057 | 16:26:01.839778 | 16:26:01.839808 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001058 | 16:26:01.839810 | 16:26:01.839848 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001059 | 16:26:01.839886 | 16:26:01.840667 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001060 | 16:26:01.840688 | 16:26:01.840691 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 001061 | 16:26:01.840695 | 16:26:01.840732 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001062 | 16:26:01.840735 | 16:26:01.840780 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001063 | 16:26:01.841011 | 16:26:01.841114 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001064 | 16:26:01.841122 | 16:26:01.841149 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001065 | 16:26:01.841153 | 16:26:01.841173 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001066 | 16:26:01.841215 | 16:26:01.841278 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001067 | 16:26:01.843814 | 16:26:01.843961 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001068 | 16:26:01.843966 | 16:26:01.843994 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001069 | 16:26:01.843997 | 16:26:01.844019 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001070 | 16:26:01.844047 | 16:26:01.852889 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001071 | 16:26:01.855825 | 16:26:01.856474 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 001072 | 16:26:01.856507 | 16:26:01.856537 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001073 | 16:26:01.856540 | 16:26:01.856579 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001074 | 16:26:01.856635 | 16:26:01.857148 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 001075 | 16:26:01.857161 | 16:26:01.857163 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 001076 | 16:26:01.857165 | 16:26:01.857671 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 001077 | 16:26:01.857678 | 16:26:01.857712 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 001078 | 16:26:01.857714 | 16:26:01.857760 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 001079 | 16:26:01.903198 | 16:26:01.903791 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001080 | 16:26:01.912854 | 16:26:01.922413 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001081 | 16:26:01.922436 | 16:26:01.922500 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001082 | 16:26:01.922555 | 16:26:01.923109 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001083 | 16:26:01.923122 | 16:26:01.923958 | 5:QUERY_INFORMATION[0] | C0000002:NOT_IMPLEMENTED [74] | \nurl\MyServer | 55:FileRemoteProtocolInformation | |
| 001084 | 16:26:01.923972 | 16:26:01.924723 | 12:DIRECTORY_CONTROL[1] | 0:SUCCESS [84] | \nurl\MyServer | 1:QUERY Test.txt | |
| 001085 | 16:26:01.924736 | 16:26:01.924789 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001086 | 16:26:01.924791 | 16:26:01.924835 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001087 | 16:26:01.928687 | 16:26:01.929394 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-892993536:] PrimaryToken ProcessAuditId] |
| 001088 | 16:26:01.929401 | 16:26:01.929446 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001089 | 16:26:01.929449 | 16:26:01.929485 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001090 | 16:26:01.929510 | 16:26:01.929853 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001091 | 16:26:01.929862 | 16:26:01.929865 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 001092 | 16:26:01.929869 | 16:26:01.929895 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001093 | 16:26:01.929896 | 16:26:01.929931 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001094 | 16:26:01.930086 | 16:26:01.930139 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001095 | 16:26:01.930142 | 16:26:01.930167 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001096 | 16:26:01.930169 | 16:26:01.930193 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001097 | 16:26:01.930230 | 16:26:01.930287 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001098 | 16:26:01.931773 | 16:26:01.931832 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001099 | 16:26:01.931836 | 16:26:01.931861 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001100 | 16:26:01.931864 | 16:26:01.931881 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001101 | 16:26:01.931903 | 16:26:01.931957 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001102 | 16:26:01.933627 | 16:26:01.934002 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 001103 | 16:26:01.934007 | 16:26:01.934034 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001104 | 16:26:01.934037 | 16:26:01.934074 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001105 | 16:26:01.934095 | 16:26:01.934601 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\Test.txt | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 001106 | 16:26:01.934609 | 16:26:01.934611 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer\Test.txt | 34:FileNetworkOpenInformation Cr[2018/06/16 05:47:32.981] A[2018/06/29 05:39:12.914] W[2018/06/29 05:39:14.281] Ch[2018/06/29 05:39:14.315] EOF[1,265,519] Attr[20:|ARCHIVE] | |
| 001107 | 16:26:01.934614 | 16:26:01.935005 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer\Test.txt | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 001108 | 16:26:01.935012 | 16:26:01.935078 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 001109 | 16:26:01.935080 | 16:26:01.935129 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\Test.txt | ||
| 001110 | 16:26:01.950454 | 16:26:01.956134 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[-845086720:] PrimaryToken ProcessAuditId] |
| 001111 | 16:26:01.956146 | 16:26:01.956179 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001112 | 16:26:01.956183 | 16:26:01.956222 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER\ | ||
| 001113 | 16:26:01.956260 | 16:26:01.956644 | 0:CREATE[0] | 0:SUCCESS [1] | \NURL\MYSERVER | 1:OPEN 1:OPENED Opt[1000020:|SYNCHRONOUS_IO_NONALERT] Name[] Type[] | SecurityContext: FullOptions[20:|SYNCHRONOUS_IO_NONALERT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001114 | 16:26:01.956656 | 16:26:01.956659 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [212] | \NURL\MYSERVER | 49:FileNetworkPhysicalNameInformation \NURL\MYSERVER | |
| 001115 | 16:26:01.956664 | 16:26:01.956691 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001116 | 16:26:01.956693 | 16:26:01.956730 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\MYSERVER | ||
| 001117 | 16:26:01.956898 | 16:26:01.956956 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001118 | 16:26:01.956960 | 16:26:01.956992 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001119 | 16:26:01.956995 | 16:26:01.957013 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001120 | 16:26:01.957040 | 16:26:01.957104 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001121 | 16:26:01.958833 | 16:26:01.958933 | 0:CREATE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | 1:OPEN 0:SUPERSEDED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245694977:] PrimaryToken ProcessAuditId] |
| 001122 | 16:26:01.958937 | 16:26:01.958998 | 18:CLEANUP[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001123 | 16:26:01.959001 | 16:26:01.959021 | 2:CLOSE[0] | 0:SUCCESS [0] | \NURL\PIPE\ | ||
| 001124 | 16:26:01.959068 | 16:26:01.959151 | 0:CREATE[0] | C0000225:NOT_FOUND [0] | \NURL\PIPE\srvsvc | 1:OPEN 0:SUPERSEDED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] ACCESS_STATE AuxData Flags[1] RemainingDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[12019F:|READ_DATA|WRITE_DATA|APPEND_DATA|READ_EA|WRITE_EA|READ_ATTRIBUTES|WRITE_ATTRIBUTES|READ_CONTROL|SYNC] SubjectSecurityContext[ImpersonationLevel[1:Ident] PrimaryToken ProcessAuditId] |
| 001125 | 16:26:01.962722 | 16:26:01.963270 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[927526096:] PrimaryToken ProcessAuditId] |
| 001126 | 16:26:01.963279 | 16:26:01.963313 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001127 | 16:26:01.963315 | 16:26:01.963359 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001128 | 16:26:01.963431 | 16:26:01.963842 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Name[] Type[] | SecurityContext: FullOptions[200020:|SYNCHRONOUS_IO_NONALERT|OPEN_REPARSE_POINT] Access[100080:|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100080:|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[249937641:] PrimaryToken ProcessAuditId] |
| 001129 | 16:26:01.963858 | 16:26:01.963861 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [38] | \nurl\MyServer | 34:FileNetworkOpenInformation EOF[0] Attr[10:|DIRECTORY] | |
| 001130 | 16:26:01.963864 | 16:26:01.964311 | 13:FILE_SYSTEM_CONTROL[0] | C00000BB:NOT_SUPPORTED [40] | \nurl\MyServer | USER FSCTL[30:FSCTL_CREATE_OR_GET_OBJECT_ID] | |
| 001131 | 16:26:01.964335 | 16:26:01.964425 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001132 | 16:26:01.964428 | 16:26:01.964472 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer | ||
| 001133 | 16:34:45.249771 | 16:34:45.255624 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[245695745:] PrimaryToken ProcessAuditId] |
| 001134 | 16:34:45.255635 | 16:34:45.255671 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001135 | 16:34:45.255674 | 16:34:45.255716 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001136 | 16:34:45.255746 | 16:34:45.256079 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001137 | 16:34:45.256091 | 16:34:45.256093 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 001138 | 16:34:45.256097 | 16:34:45.256100 | 12:DIRECTORY_CONTROL[2] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer | 2:NOTIFY | |
| 001139 | 16:34:45.256183 | 16:34:45.256537 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer\ | 1:OPEN 1:OPENED Opt[1004021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Attr[80:|NORMAL] Name[] Type[] | SecurityContext: FullOptions[4021:|DIRECTORY_FILE|SYNCHRONOUS_IO_NONALERT|OPEN_FOR_BACKUP_INTENT] Access[100001:|READ_DATA|SYNC] ACCESS_STATE AuxData Flags[103] RemainingDesiredAccess[0:] PreviouslyGrantedAccess[100001:|READ_DATA|SYNC] OriginalDesiredAccess[100001:|READ_DATA|SYNC] SubjectSecurityContext[ImpersonationLevel[142:] PrimaryToken ProcessAuditId] |
| 001140 | 16:34:45.256543 | 16:34:45.256568 | 18:CLEANUP[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001141 | 16:34:45.256570 | 16:34:45.256606 | 2:CLOSE[0] | 0:SUCCESS [0] | \nurl\MyServer\ | ||
| 001142 | 16:34:45.256627 | 16:34:45.256947 | 0:CREATE[0] | 0:SUCCESS [1] | \nurl\MyServer | 1:OPEN 1:OPENED Opt[1000000:] Name[] Type[] | SecurityContext: FullOptions[0:] Access[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] ACCESS_STATE AuxData Flags[101] RemainingDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] PreviouslyGrantedAccess[0:] OriginalDesiredAccess[100081:|READ_DATA|READ_ATTRIBUTES|SYNC] SubjectSecurityContext[ImpersonationLevel[0:Anon] PrimaryToken ProcessAuditId] |
| 001143 | 16:34:45.256955 | 16:34:45.256957 | 5:QUERY_INFORMATION[0] | 0:SUCCESS [28] | \nurl\MyServer | 4:FileBasicInformation Attr[10:|DIRECTORY] | |
| 001144 | 16:34:45.256960 | 16:34:45.256962 | 12:DIRECTORY_CONTROL[2] | C00000BB:NOT_SUPPORTED [0] | \nurl\MyServer | 2:NOTIFY | |
Comments are moderated. Anonymous comments are not visible to others until moderated. Comments are owned by the author but may be removed or reused (but not modified) by this site at any time without notice.