Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances.

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Epoch

Firewall related?

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

What could be changing interface settings? Does it get updated every reboot? During use?

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ASP.NET_2.0.50727\Names

PIDs of worker processes. Seems legit.

The list goes on - I'd like to be able to look up and find out about any registry entry that changes. The alerts are useless if I can't understand them.

share|improve this question
    
Microsot has fairly detailed registry explanations on Technet and even public knowledgebases. –  SpacemanSpiff Dec 15 '11 at 12:57
    
@SpacemanSpiff I've found the 2003 Technet reference listed in this ticket, but not 2008 R2. The Epoch key is not listed in the 2003 reference. –  Tom Paine Dec 15 '11 at 13:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.