Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a resource for looking up the description and/or usage of W2K8 R2 registry keys? I need to understand integrity checksum change messages appearing in OSSEC logs on Amazon EC2 instances.

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Epoch

Firewall related?

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

What could be changing interface settings? Does it get updated every reboot? During use?

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ASP.NET_2.0.50727\Names

PIDs of worker processes. Seems legit.

The list goes on - I'd like to be able to look up and find out about any registry entry that changes. The alerts are useless if I can't understand them.

share|improve this question
Microsot has fairly detailed registry explanations on Technet and even public knowledgebases. – SpacemanSpiff Dec 15 '11 at 12:57
@SpacemanSpiff I've found the 2003 Technet reference listed in this ticket, but not 2008 R2. The Epoch key is not listed in the 2003 reference. – xddsg Dec 15 '11 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.