Intrust Repository Viewer - ComputerType

Question

Hello, I am reviewing the predefined reports within Intrust (v11.4 but I don't think that matters) and within some of the Active Directory change reports is a Custom filter with the following syntax: 
 
 (ComputerType & 24!=0) 
 
 Any help in understanding what this is telling me would be appreciated. Also if there is a list of available values that could help. TIA

Igor.Ilyin · Accepted Answer

Hi akshar oza, 
 (ComputerType & 24 != 0) is a computer type mask of a Domain Controller. The bits are declared in LMServer.h file which can be found in Windows SDK. Described also here: https://docs.microsoft.com/en-us/windows/win32/api/lmserver/ns-lmserver-_server_info_102 . The mask means that PDC bit (#4) or BDC bit (#5) is equal to 1. 
 We use another mask for a Workstation: (ComputerType & 32792 = 0) and (ComputerType & 1 != 0), which means not PDC (#4), and not BDC (#5), and not Other server (#16), and is Workstation (#1). 
 We do not use any mask in Servers searches in Repository Viewer, which means they return events from all computer types. 
 The computer type is enclosed in each event in the Repository. 
 SV_TYPE_WORKSTATION 0x00000001 A workstation. SV_TYPE_SERVER 0x00000002 A server. SV_TYPE_SQLSERVER 0x00000004 A server running with Microsoft SQL Server. SV_TYPE_DOMAIN_CTRL 0x00000008 A primary domain controller. 
 SV_TYPE_DOMAIN_BAKCTRL 0x00000010 A backup domain controller. SV_TYPE_TIME_SOURCE 0x00000020 A server running the Timesource service. SV_TYPE_AFP 0x00000040 A server running the Apple Filing Protocol (AFP) file service. SV_TYPE_NOVELL 0x00000080 A Novell server. 
 SV_TYPE_DOMAIN_MEMBER 0x00000100 A LAN Manager 2.x domain member. SV_TYPE_PRINTQ_SERVER 0x00000200 A server that shares a print queue. SV_TYPE_DIALIN_SERVER 0x00000400 A server that runs a dial-in service. SV_TYPE_XENIX_SERVER 0x00000800 A Xenix or Unix server. 
 SV_TYPE_NT 0x00001000 A workstation or server. SV_TYPE_WFW 0x00002000 A computer that runs Windows for Workgroups. SV_TYPE_SERVER_MFPN 0x00004000 A server that runs the Microsoft File and Print for NetWare service. SV_TYPE_SERVER_NT 0x00008000 Any server that is not a domain controller. 
 SV_TYPE_POTENTIAL_BROWSER 0x00010000 A computer that can run the browser service. SV_TYPE_BACKUP_BROWSER 0x00020000 A server running a browser service as backup. SV_TYPE_MASTER_BROWSER 0x00040000 A server running the master browser service. SV_TYPE_DOMAIN_MASTER 0x00080000 A server running the domain master browser. 
 SV_TYPE_SERVER_OSF 0x00100000 A computer that runs OSF. SV_TYPE_SERVER_VMS 0x00200000 A computer that runs VMS. SV_TYPE_WINDOWS 0x00400000 A computer that runs Windows. SV_TYPE_DFS 0x00800000 A server that is the root of a DFS tree. 
 SV_TYPE_CLUSTER_NT 0x01000000 A server cluster available in the domain. SV_TYPE_TERMINALSERVER 0x02000000 A server that runs the Terminal Server service. SV_TYPE_CLUSTER_VS_NT 0x04000000 Cluster virtual servers available in the domain. Windows 2000: This value is not supported. 0x08000000 - 
 SV_TYPE_DCE 0x10000000 A server that runs the DCE Directory and Security Services or equivalent. SV_TYPE_ALTERNATE_XPORT 0x20000000 A server that is returned by an alternate transport. SV_TYPE_LOCAL_LIST_ONLY 0x40000000 A server that is maintained by the browser. SV_TYPE_DOMAIN_ENUM 0x80000000 A primary domain.

Intrust Repository Viewer - ComputerType

Top Replies