Windows / Code / 0x00001009
0x00001009
Decimal: 4105 · Signed: 4105
As HRESULT:- S: 0 (Success)
- C: 0 (Microsoft-defined)
- N: 0 (Not an NTSTATUS value)
- Facility: 0x000 (FACILITY_NULL: Default)
- Code: 0x1009 (4105)
As NTSTATUS:- Sev: 0 (STATUS_SEVERITY_SUCCESS)
- C: 0 (Microsoft-defined)
- Facility: 0x000 (Default)
- Code: 0x1009 (4105)
Associated Modules
| Module | Found in | Description |
|---|
| VSSVC.exe | 1011 | Volume Shadow Copy Service error: Cannot save the changes for the COM+ collection [%1].
%2 |
| auditpol.exe | 8.11011 | Usage: AuditPol /resourceSACL
[/set /type: [/success] [/failure] /user:
[/access:] [/condition:]]
[/remove /type: /user: [/type:]]
[/clear [/type:]]
[/view [/user:] [/type:]]
This command configures settings for global object access auditing. The
corresponding object access subcategory needs to be enabled for the events
to be generated by the system. Type auditpol /set /? for more information.
Commands
/? Displays Help for the command.
/set Adds a new entry to or updates an existing entry in the
resource system access control list for the resource type
specified.
/remove Removes all entries for the given user from the global
object access auditing list specified by the resource
type.
/clear Removes all entries from the global object access auditing
list for the specified resource type.
/view Lists the global object access auditing entries for the
specified resource type and user. Specifying a user is
optional.
Arguments
/type The resource for which object access auditing is being
configured. The supported argument values are File and
Key. Note that these values are case sensitive.
File: Directories and files.
Key: Registry keys.
/success Specifies success auditing.
/failure Specifies failure auditing.
/user Specifies a user in one of the following forms:
- DomainName\Account (such as DOM\Administrators)
- StandaloneServer\Group
- Account (see LookupAccountName API)
- {S-1-x-x-x-x}. x is expressed in decimal, and the entire
SID must be enclosed in curly braces.
For example: {S-1-5-21-5624481-130208933-164394174-1001}
Warning: If SID form is used, no check is done to verify
the existence of this account.
/access Specifies a permission mask that can be specified in one
of two forms:
- A sequence of simple rights:
Generic access rights:
GA - GENERIC ALL
GR - GENERIC READ
GW - GENERIC WRITE
GX - GENERIC EXECUTE
Access rights for files:
FA - FILE ALL ACCESS
FR - FILE GENERIC READ
FW - FILE GENERIC WRITE
FX - FILE GENERIC EXECUTE
Access rights for registry keys:
KA - KEY ALL ACCESS
KR - KEY READ
KW - KEY WRITE
KX - KEY EXECUTE
For example: '/access:FRFW' will enable audit events
for read and write operations.
- A hex value representing the access mask (such as
0x1200a9).
This is useful when using resource-specific bit masks
that are not part of the SDDL standard. If omitted,
Full access is used.
/condition Appends an attribute based expression like the following:
Document sensitivity is HBI ("High")
"(@Resource.Sensitivity == \"High\")"
Examples:
auditpol /resourceSACL /set /type:Key /user:MYDOMAIN\myuser /success
auditpol /resourceSACL /set /type:File /user:MYDOMAIN\myuser /success
/failure /access:FRFW
auditpol /resourceSACL /set /type:File /user:everyone /success
/failure /access:FRFW /condition:"(@Resource.Sensitivity == \"High\")"
auditpol /resourceSACL /type:File /clear
auditpol /resourceSACL /remove /type:File
/user:{S-1-5-21-56248481-1302087933-1644394174-1001}
auditpol /resourceSACL /type:File /view
auditpol /resourceSACL /type:File /view /user:MYDOMAIN\myuser |
| auditpol.exe | 7 | Usage: AuditPol /resourceSACL
[/set /type: [/success] [/failure] /user:
[/access:]]
[/remove /type: /user: [/type:]]
[/clear [/type:]]
[/view [/user:] [/type:]]
This command configures settings for global object access auditing. The
corresponding object access subcategory needs to be enabled for the events
to be generated by the system. Type auditpol /set /? for more information.
Commands
/? Displays Help for the command.
/set Adds a new entry to or updates an existing entry in the
resource system access control list for the resource type
specified.
/remove Removes all entries for the given user in the global
object access auditing list. If the type is not specified,
all entries for the user are removed.
/clear Removes all entries from the global object access auditing
list.
If the type is omitted, all entries are removed.
/view Lists the global object access auditing entries in a
resource system access control list, filtered by the given
user and resource type. The user and resource types are
optional.
Arguments
/type The resource for whom object access auditing is
being configured.
The supported values for resources are File and Key.
File: Directories and files.
Key: Registry keys.
/success Specifies success auditing.
/failure Specifies failure auditing.
/user Specifies a user in one of the following forms:
- DomainName\Account (such as DOM\Administrators)
- StandaloneServer\Group
- Account (see LookupAccountName API)
- {S-1-x-x-x-x}. x is expressed in decimal, and the entire
SID must be enclosed in curly braces.
For example: {S-1-5-21-5624481-130208933-164394174-1001}
Warning: If SID form is used, no check is done to verify
the existence of this account.
/access Specifies a permission mask that can be specified in one
of two forms:
- A sequence of simple rights:
Generic access rights:
GA - GENERIC ALL
GR - GENERIC READ
GW - GENERIC WRITE
GX - GENERIC EXECUTE
Access rights for files:
FA - FILE ALL ACCESS
FR - FILE GENERIC READ
FW - FILE GENERIC WRITE
FX - FILE GENERIC EXECUTE
Access rights for registry keys:
KA - KEY ALL ACCESS
KR - KEY READ
KW - KEY WRITE
KX - KEY EXECUTE
For example: '/access:FRFW' will enable audit events
for read and write operations.
- A hex value representing the access mask (such as
0x1200a9).
This is useful when using resource-specific bit masks
that are not part of the SDDL standard. If omitted,
Full access is used.
Examples:
auditpol /resourceSACL /set /type:Key /user:MYDOMAIN\myuser /success
auditpol /resourceSACL /set /type:File /user:MYDOMAIN\myuser /success
/failure /access:FRFW
auditpol /resourceSACL /type:File /clear
auditpol /resourceSACL /remove /type:File
/user:{S-1-5-21-56248481-1302087933-1644394174-1001}
auditpol /resourceSACL /type:File /view
auditpol /resourceSACL /type:File /view /user:MYDOMAIN\myuser |
| auditpolcore.dll | 1011 | Machine Name,Policy Target,Subcategory,Subcategory GUID,Inclusion Setting,Exclusion Setting,Setting Value |
| bootsect.exe | 1011 | Could not map drive %1!c!: to an associated volume device object. |
| crypt32.dll | 78.11011 | Untrusted root certificate:: Subject: <%1> Sha1 thumbprint: <%2>. |
| dxgwdi.dll | 1011 | Forced (usually test) TDR has been ignored, due to being delivered in a prohibited context. |
| gpsvc.dll | 78.11011 | Access check based on security descriptor failed. |
| ntfs.sys | 1011 | Invalid Security Id |
| sdengin2.dll | 1011 | The primary backup catalog is either missing or corrupted. Backup will use the secondary catalog. |
| 10 entries |
Associated Headers