2.1 caller group
- Group:
caller - Defined in:
lcs.evman
The identity LCS records on an audited operation. A deliberate subset of
subject — the token's durable GUIDs ride in the event header, and the
group SIDs and PIP state that KACS records are absent here.
That absence is a gap rather than a design. Access to a registry key is granted through a group as often as to a user SID directly, so an LCS record cannot answer "which membership let this through" where the equivalent KACS record can. The two subsystems reached the bound on what to serialise independently and landed in different places.
2.1.1 Fields #
| Field | Type | Meaning |
|---|---|---|
subject.token.sid | bin.sid | The user SID of the effective token the operation ran under. |
subject.token.integrity | uint.integrity | The integrity RID of the effective token. |
subject.token.id | uint.luid | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | The impersonation level of the effective token. |
2.1.2 Carried by #
lcs.audit.backup.endedlcs.audit.backup.startedlcs.audit.key.createdlcs.audit.key.deletedlcs.audit.key.descriptor.changedlcs.audit.key.hiddenlcs.audit.key.openedlcs.audit.key.tombstonedlcs.audit.restore.endedlcs.audit.restore.startedlcs.audit.transaction.committedlcs.audit.value.deletedlcs.audit.value.set
Generated from lcs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.