Microsoft-Windows-IIS-IisMetabaseAudit

Event	Title	Channel	Sample	Rule
4500	Metabase Add Key.	Operational	N	N
4501	Metabase Delete Key.	Operational	N	N
4502	Metabase Delete Child Keys.	Operational	N	N
4503	Metabase Copy Key.	Operational	N	N
4504	Metabase Rename Key.	Operational	N	N
4505	Metabase Set Data.	Operational	N	N
4506	Metabase Delete Data.	Operational	N	N
4507	Metabase Delete All Data.	Operational	N	N
4508	Metabase Copy Data.	Operational	N	N
4509	Metabase Set Last Change Time.	Operational	N	N
4510	Metabase Restore.	Operational	N	N
4511	Metabase Delete Backup.	Operational	N	N
4512	Metabase Import.	Operational	N	N

Event ID 4500: Metabase Add Key.

Channel: Operational

Message #

Metabase Add Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4501: Metabase Delete Key.

Channel: Operational

Message #

Metabase Delete Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4502: Metabase Delete Child Keys.

Channel: Operational

Message #

Metabase Delete Child Keys.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4503: Metabase Copy Key.

Channel: Operational

Message #

Metabase Copy Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 Destination Path: %5
 Caller PID: %6
 Caller Image Path: %7
 Result: %8

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabaseSourcePath` UnicodeString
`MetabaseDestinationPath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4504: Metabase Rename Key.

Channel: Operational

Message #

Metabase Rename Key.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 New Key Name: %5
 Caller PID: %6
 Caller Image Path: %7
 Result: %8

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabaseSourcePath` UnicodeString
`NewKeyName` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4505: Metabase Set Data.

Channel: Operational

Message #

Metabase Set Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Property ID: %5
 Property Name: %6
 Old Value: %7
 New Value: %8
 Caller PID: %9
 Caller Image Path: %10
 Result: %11

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`PropertyID` UnicodeString
`PropertyName` UnicodeString
`OldValue` UnicodeString
`NewValue` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4506: Metabase Delete Data.

Channel: Operational

Message #

Metabase Delete Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Property ID: %5
 Property Name: %6
 Old Value: %7
 Caller PID: %8
 Caller Image Path: %9
 Result: %10

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`PropertyID` UnicodeString
`PropertyName` UnicodeString
`OldValue` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4507: Metabase Delete All Data.

Channel: Operational

Message #

Metabase Delete All Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4508: Metabase Copy Data.

Channel: Operational

Message #

Metabase Copy Data.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 Destination Path: %5
 Caller PID: %6
 Caller Image Path: %7
 Result: %8

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabaseSourcePath` UnicodeString
`MetabaseDestinationPath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4509: Metabase Set Last Change Time.

Channel: Operational

Message #

Metabase Set Last Change Time.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Path: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabasePath` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4510: Metabase Restore.

Channel: Operational

Message #

Metabase Restore.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Name of Backup: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`BackupName` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4511: Metabase Delete Backup.

Channel: Operational

Message #

Metabase Delete Backup.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Name of Backup: %4
 Caller PID: %5
 Caller Image Path: %6
 Result: %7

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`BackupName` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Event ID 4512: Metabase Import.

Channel: Operational

Message #

Metabase Import.
 
 Primary User Name: %1
 Primary User Domain: %2
 Primary Logon ID: %3
 Source Path: %4
 Destination Path: %5
 Filename: %6
 Caller PID: %7
 Caller Image Path: %8
 Result: %9

Fields #

Name	Description
`UserName` UnicodeString
`Domain` UnicodeString
`LogonID` UnicodeString
`MetabaseSourcePath` UnicodeString
`MetabaseDestinationPath` UnicodeString
`ImportFileName` UnicodeString
`CallerPID` UnicodeString
`CallerImagePath` UnicodeString
`Result` UnicodeString

Provenance

ETW provider GUID bbb924b8-f415-4f57-aa45-1007f704c9b1

Defined in iisres.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB