up vote 0 down vote favorite
share [g+] share [fb]

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances.

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Epoch

Firewall related?

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

What could be changing interface settings? Does it get updated every reboot? During use?

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ASP.NET_2.0.50727\Names

PIDs of worker processes. Seems legit.

The list goes on - I'd like to be able to look up and find out about any registry entry that changes. The alerts are useless if I can't understand them.

link|improve this question
75% accept rate
Microsot has fairly detailed registry explanations on Technet and even public knowledgebases. – SpacemanSpiff Dec 15 '11 at 12:57
@SpacemanSpiff I've found the 2003 Technet reference listed in this ticket, but not 2008 R2. The Epoch key is not listed in the 2003 reference. – Tom Paine Dec 15 '11 at 13:11
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.