# 5.2 lcs.audit.backup.started

_Peios / Using Peios / Events / Registry Events_

> The record that a registry subtree backup began, emitted before any data is read.

- **Event type:** `lcs.audit.backup.started`
- **Defined in:** `lcs.evman`
- **Tier:** essential
- **Gating:** none — audited unconditionally
- **Cardinality:** one record per occurrence

The record that a registry subtree backup began, emitted **before any data
is read**. Backup is a privilege-gated bulk operation that bypasses
per-key access checks entirely, so this trail is the only evidence it
happened at all — which is why it is audited whatever the target key's
SACL says.

The start record exists so that an operation dying partway still leaves
evidence that it began. A start with no matching end is itself the
finding.

Emission failure fails the operation with `EIO`, unlike every other LCS
event: an unrecorded bulk read of the configuration store is not permitted
to proceed.

## 5.2.1 Fields

| Field | Type | Presence | Meaning |
|---|---|---|---|
| [`subject.token.sid`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.sid) | `bin.sid` | via [`caller`](/peios/using-peios/events/groups/group-caller.md) | The user SID of the effective token the operation ran under. |
| [`subject.token.integrity`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.integrity) | `uint.integrity` | via [`caller`](/peios/using-peios/events/groups/group-caller.md) | The integrity RID of the effective token. |
| [`subject.token.id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.id) | `uint.luid` | via [`caller`](/peios/using-peios/events/groups/group-caller.md) | The token's own LUID, identifying this specific token rather than the logon session it belongs to. |
| [`subject.token.auth-id`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.auth-id) | `uint.luid` | via [`caller`](/peios/using-peios/events/groups/group-caller.md) | The LUID of the logon session the effective token belongs to. |
| [`subject.token.type`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.type) | `str.enum` | via [`caller`](/peios/using-peios/events/groups/group-caller.md) | Whether the effective token is a primary token or an impersonation token. |
| [`subject.token.impersonation`](/peios/using-peios/events/field-index/fields-subject.md#subject.token.impersonation) | `uint.enum` | via [`caller`](/peios/using-peios/events/groups/group-caller.md) | The impersonation level of the effective token. |
| [`object.key.guid`](/peios/using-peios/events/field-index/fields-object.md#object.key.guid) | `bin.guid` | required | The registry key an operation acted on. |
| [`operation.fd`](/peios/using-peios/events/field-index/fields-operation.md#operation.fd) | `uint` | required | The descriptor the backup stream was written to. |

Every record also carries the header fields of [the envelope](/peios/using-peios/events/introduction/the-envelope.md), which no payload repeats.

*Generated from `lcs.evman` by `pkm/tools/gen-events-book.py`. Edit the fragment, not this page.*