5.2 lcs.audit.backup.started
- Event type:
lcs.audit.backup.started - Defined in:
lcs.evman - Tier: essential
- Gating: none — audited unconditionally
- Cardinality: one record per occurrence
The record that a registry subtree backup began, emitted before any data is read. Backup is a privilege-gated bulk operation that bypasses per-key access checks entirely, so this trail is the only evidence it happened at all — which is why it is audited whatever the target key's SACL says.
The start record exists so that an operation dying partway still leaves evidence that it began. A start with no matching end is itself the finding.
Emission failure fails the operation with EIO, unlike every other LCS
event: an unrecorded bulk read of the configuration store is not permitted
to proceed.
5.2.1 Fields #
| Field | Type | Presence | Meaning |
|---|---|---|---|
subject.token.sid | bin.sid | via caller | The user SID of the effective token the operation ran under. |
subject.token.integrity | uint.integrity | via caller | The integrity RID of the effective token. |
subject.token.id | uint.luid | via caller | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
subject.token.auth-id | uint.luid | via caller | The LUID of the logon session the effective token belongs to. |
subject.token.type | str.enum | via caller | Whether the effective token is a primary token or an impersonation token. |
subject.token.impersonation | uint.enum | via caller | The impersonation level of the effective token. |
object.key.guid | bin.guid | required | The registry key an operation acted on. |
operation.fd | uint | required | The descriptor the backup stream was written to. |
Every record also carries the header fields of the envelope, which no payload repeats.
Generated from lcs.evman by pkm/tools/gen-events-book.py. Edit the fragment, not this page.