Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check Owner option doesn't works in windows agent #1425

Closed
FreddMadison opened this issue May 23, 2018 · 4 comments
Closed

Check Owner option doesn't works in windows agent #1425

FreddMadison opened this issue May 23, 2018 · 4 comments

Comments

@FreddMadison
Copy link
Contributor

FreddMadison commented May 23, 2018

  1. Deploy HIDS agent on Windows

  2. Add real-time monitoring for C:\Test directory in agent ossec.conf
    C:\Test

  1. Create 1.txt file in C:\Test folder

  2. /etc/init.d/ossec restart

  3. Check that C:\Test directory is being monitored in real time by ossec agent and wait until real-time file monitoring starts by writing something into 1.txt and checking tail of ossec.log

  4. Change the file owner of the 1.txt thru File Properties dialog and check ossec.log

Actual Behavior: No log events appears in ossec.log
Expected Behavior: ossec.log should contain data about owner change detection and event should be sent to server

@FreddMadison
Copy link
Contributor Author

msdn stat() function: "st_uid - Numeric identifier of user who owns file (UNIX-specific). This field will always be zero on Windows systems."

@ddpbsd
Copy link
Member

ddpbsd commented May 23, 2018

Maybe something from here can be adapted.
In particular GetSecurityInfo and LookupAccountSid

@FreddMadison
Copy link
Contributor Author

Yes, that's exactly what should be and will be done

@ddpbsd
Copy link
Member

ddpbsd commented May 29, 2018

Pull request #1428 has been merged.

@ddpbsd ddpbsd closed this as completed May 29, 2018
@billy-shears billy-shears mentioned this issue May 29, 2018
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants