Share via

Sample Metabase Auditing Event Log

  • Article

Applies To: Windows Server 2003 with SP1

The Security log shows Metabase Audit Log Message Event ID 4505 indicating a set data metabase auditing event that changed the MaxConnections property ID 1014 from the old value of 4294967295 to a new value of 2. The Security log event header information is repeated in the detailed view of the event.

Event Type:Success Audit
Event Source:IIS-METABASE
Event Category:Object Access 
Event ID:4505
Date:8/22/2006
Time:1:49:42 PM
User:NT AUTHORITY\SYSTEM
Computer:ATestMachine
Description:
Metabase Set Data
 Primary User Name: SYSTEM
 Primary User Domain: NT AUTHORITY
 Primary Logon ID: (0x0,0x3E7)
 Path: /LM/W3SVC
 Property ID: 1014
 Property Name: MaxConnections
 Old Value: 4294967295
 New Value: 2
 Caller PID: 2588
 Caller Image Path: \Device\HarddiskVolume1\WINNT\system32\inetsrv\inetinfo.exe - EWR
 Result: 0x0

For information about using metabase auditing, see Metabase Auditing.

For information about enabling metabase auditing, see Auditing the Metabase.