nasbench / EVTX-ETW-Resources

Event Tracing For Windows (ETW) Resources

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Server role manifests?

jdu2600 opened this issue · comments

Hey @nasbench

I just noticed that some manifests aren't installed by default - and require the OS feature to be enabled first.

For example, you need to add the DNS Server Role before Microsoft-Windows-DNSServer.man appears.

There might be some interesting Server ETW channels that we've missed...

John

Yo @jdu2600

Yeah, the workflow until for gathering these manifests was to spawn a VM run the script and collect the data. But I agree that having the manifests for the different roles and services is needed.

I'll check with @AndrewRathbun on how we can achieve this with the next batches.

Cheers

Any idea what the workflow looks like to enumerate these manifests? I've never been a sysadmin before so I don't have any experience toying around with Server much outside of acquisition/triage.

From my understanding. We just enable/install the feature using Powershell with the Install-WindowsFeature or similar and then after reboot (or before) the manifestst should be registered for us to grab

https://learn.microsoft.com/en-us/powershell/module/servermanager/install-windowsfeature?view=windowsserver2022-ps

Pasting this for posterity. Will spin up a VM when I get a chance and toy around with some of these commands.