5890(S): An object was added to the COM+ Catalog.
Subcategory: Audit Other Object Access Events
Event Description:
This event generates when new object was added to the COM+ Catalog.
For some reason this event belongs to Audit System Integrity subcategory, but generation of this event enables in this subcategory.
Note For recommendations, see Security Monitoring Recommendations for this event.
Event XML:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>5890</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-09-23T19:45:04.239886800Z" />
<EventRecordID>344980</EventRecordID>
<Correlation />
<Execution ProcessID="516" ThreadID="2856" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-21-3457937927-2839227994-823803824-1104</Data>
<Data Name="SubjectUserName">dadmin</Data>
<Data Name="SubjectUserDomainName">CONTOSO</Data>
<Data Name="SubjectLogonId">222443</Data>
<Data Name="ObjectCollectionName">Roles</Data>
<Data Name="ObjectIdentifyingProperties">ApplId = {1D34B2DC-0E43-4040-BA7B-2F1C181FD86A} Name = CreatorOwner</Data>
<Data Name="ObjectProperties">Description =</Data>
</EventData>
</Event>
Required Server Roles: None.
Minimum OS Version: Windows Server 2008, Windows Vista.
Event Versions: 0.
Field Descriptions:
Subject:
- Security ID [Type = SID]: SID of account that requested the “add object” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event.
Note A security identifier (SID) is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see Security identifiers.
Account Name [Type = UnicodeString]: the name of the account that requested the “add object” operation.
Account Domain [Type = UnicodeString]: subject’s domain or computer name. Formats vary, and include the following:
Domain NETBIOS name example: CONTOSO
Lowercase full domain name: contoso.local
Uppercase full domain name: CONTOSO.LOCAL
For some well-known security principals, such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”.
For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”.
Logon ID [Type = HexInt64]: hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “4624: An account was successfully logged on.”
Object:
- COM+ Catalog Collection [Type = UnicodeString]: the name of COM+ collection to which the new object was added. Here is the list of possible collection values with descriptions:
| Collection | Description |
|---|---|
| ApplicationCluster | Contains a list of the servers in the application cluster. |
| ApplicationInstances | Contains an object for each instance of a running COM+ application. |
| Applications | Contains an object for each COM+ application installed on the local computer. |
| Components | Contains an object for each component in the application to which it is related. |
| ComputerList | Contains a list of the computers found in the Computers folder of the Component Services administration tool. |
| DCOMProtocols | Contains a list of the protocols to be used by DCOM. It contains an object for each protocol. |
| ErrorInfo | Retrieves extended error information regarding methods that deal with multiple objects. |
| EventClassesForIID | Retrieves information regarding event classes. |
| FilesForImport | Retrieves information from its MSI file about an application that can be imported. |
| InprocServers | Contains a list of the in-process servers registered with the system. It contains an object for each component. |
| InterfacesForComponent | Contains an object for each interface exposed by the component to which the collection is related. |
| LegacyComponents | Contains an object for each unconfigured component in the application to which it is related. |
| LegacyServers | Identical to the InprocServers collection except that this collection also includes local servers. |
| LocalComputer | Contains a single object that holds computer level settings information for the computer whose catalog you are accessing. |
| MethodsForInterface | Contains an object for each method on the interface to which the collection is related. |
| Partitions | Used to specify the applications contained in each partition. |
| PartitionUsers | Used to specify the users contained in each partition. |
| PropertyInfo | Retrieves information about the properties that a specified collection supports. |
| PublisherProperties | Contains an object for each publisher property for the parent SubscriptionsForComponent collection. |
| RelatedCollectionInfo | Retrieves information about other collections related to the collection from which it is called. |
| Roles | Contains an object for each role assigned to the application to which it is related. |
| RolesForComponent | Contains an object for each role assigned to the component to which the collection is related. |
| RolesForInterface | Contains an object for each role assigned to the interface to which the collection is related. |
| RolesForMethod | Contains an object for each role assigned to the method to which the collection is related. |
| RolesForPartition | Contains an object for each role assigned to the partition to which the collection is related. |
| Root | Contains the top-level collections on the catalog. |
| SubscriberProperties | Contains an object for each subscriber property for the parent SubscriptionsForComponent collection. |
| SubscriptionsForComponent | Contains an object for each subscription for the parent Components collection. |
| TransientPublisherProperties | Contains an object for each publisher property for the parent TransientSubscriptions collection. |
| TransientSubscriberProperties | Contains an object for each subscriber property for the parent TransientSubscriptions collection. |
| TransientSubscriptions | Contains an object for each transient subscription. |
| UsersInPartitionRole | Contains an object for each user in the partition role to which the collection is related. |
| UsersInRole | Contains an object for each user in the role to which the collection is related. |
| WOWInprocServers | Contains a list of the in-process servers registered with the system for 32-bit components on 64-bit computers. |
| WOWLegacyServers | Identical to the LegacyServers collection except that this collection is drawn from the 32-bit registry on 64-bit computers. |
Object Name [Type = UnicodeString]: object-specific fields with the names and identifiers for the new object. It depends on COM+ Catalog Collection value, for example, if COM+ Catalog Collection = Applications, then you can find that:
ID - A GUID representing the application. This property is returned when the Key property method is called on an object of this collection.
AppPartitionID - A GUID representing the application partition ID.
Note GUID is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances.
Object Details [Type = UnicodeString]: the list of new object’s (Object Name) properties.
The items have the following format: Property_Name = VALUE
Check description for specific COM+ Catalog Collection to see the list of object’s properties and descriptions.
Security Monitoring Recommendations
For 5890(S): An object was added to the COM+ Catalog.
Important For this event, also see Appendix A: Security monitoring recommendations for many audit events.
- If you need to monitor for creation of new COM+ objects within specific COM+ collection, monitor all 5890 events with the corresponding COM+ Catalog Collection field value.