dissect.target.plugins.os.windows.ual#

Module Contents#

Classes#

UalPlugin

Return all available User Access Log information.

Attributes#

ClientAccessRecord

RoleAccessRecord

VirtualMachineRecord

DomainSeenRecord

SystemIdentityRecord

FIELD_NAME_MAP

dissect.target.plugins.os.windows.ual.ClientAccessRecord#
dissect.target.plugins.os.windows.ual.RoleAccessRecord#
dissect.target.plugins.os.windows.ual.VirtualMachineRecord#
dissect.target.plugins.os.windows.ual.DomainSeenRecord#
dissect.target.plugins.os.windows.ual.SystemIdentityRecord#
dissect.target.plugins.os.windows.ual.FIELD_NAME_MAP#
class dissect.target.plugins.os.windows.ual.UalPlugin(target)#

Bases: dissect.target.plugin.Plugin

Return all available User Access Log information.

User Access Logging (UAL) is a logging system that aggregates client usage data by role and products on a local server. It helps Windows server administrators to quantify requests from client computers for roles and services on a local server.

References

__namespace__ = 'ual'#
LOG_DB_GLOB = 'sysvol/Windows/System32/LogFiles/Sum/*.mdb'#
IDENTITY_DB_FILENAME = 'SystemIdentity.mdb'#
IDENTITY_DB_PATH#
check_compatible() → None#

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

find_mdb_files()#
populate_role_guid_map()#
read_table_records(table_name)#
client_access()#

Return client access data within the User Access Logs.

role_access()#

Return role access data within the User Access Logs.

virtual_machines()#

Return virtual machine data within the User Access Logs.

domains_seen()#

Return DNS data within the User Access Logs.

system_identities()#

Return system identity data within the User Access Logs.