t2k2
10-11-2002, 01:11 PM
I am looking to find out what purpose the following key serves :
Modified: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions\\{827D3 19E-6EAC-11D2-A4EA-00C04F79F83A}"|"LastPolicyTime"
Modified: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-417627155-701249538-800090209-1004"|"ProfileLoadTimeHigh"
Modified: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-417627155-701249538-800090209-1004"|"ProfileLoadTimeLow"
I have just recently setup TripWire on a webserver, and I am researching the items that seem to show up as being modified in the registry. It appears as though the MD5 hash value is the only thing that changed, but I want to see why it changes every time there is an integrity check run on the box. Any help would be appreciated. I was not able to turn anything up with a search.
Thanks.
Modified: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions\\{827D3 19E-6EAC-11D2-A4EA-00C04F79F83A}"|"LastPolicyTime"
Modified: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-417627155-701249538-800090209-1004"|"ProfileLoadTimeHigh"
Modified: "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-417627155-701249538-800090209-1004"|"ProfileLoadTimeLow"
I have just recently setup TripWire on a webserver, and I am researching the items that seem to show up as being modified in the registry. It appears as though the MD5 hash value is the only thing that changed, but I want to see why it changes every time there is an integrity check run on the box. Any help would be appreciated. I was not able to turn anything up with a search.
Thanks.