Windows event log configuration

[woohoo]

And when you get tired of wading through the logs looking for that one off event try elex

Windows event log management software, monitor system, application and security event logs — FSPro Labs

It is bloody marvelous at filtering and exporting just the bits that matter often across multiple machines
Only one thing to bear in mind if you want to enumerate account ids don't run it off line against saved logs

I can't describe how useful this tool was to me auditing specific user access on dozens of believed redundant servers last year

Thanks for this link I will take a look, just to add another useful tool - Log Parser Studio
https://gallery.technet.microsoft.co...tudio-cd458765

[LondonManc]

You've not been asked to look at it by Paul from Microsoft Security Team have you?

[DallasDad]

And when you get tired of wading through the logs looking for that one off event try elex

Windows event log management software, monitor system, application and security event logs — FSPro Labs

It is bloody marvelous at filtering and exporting just the bits that matter often across multiple machines
Only one thing to bear in mind if you want to enumerate account ids don't run it off line against saved logs

I can't describe how useful this tool was to me auditing specific user access on dozens of believed redundant servers last year

[DaveB]

Cheers both

[Boney M]

There you go How to Configure Auditing for Privilege Elevation - Windows 7 Tutorial

[Boney M]

I'm getting seriously rusty on the technical aspects of Windows these days.

Does anyone know if the following are available to record as events?

- Use of "Run as Administrator"

- Provision of Administrator credentials when prompted by the OS

Yes they are. There are 3 tokens as I remember depending on the elevation and if it was Run as Admin, Run with credentials and run with no UAC. Cannot remember the event ID's but a quick google you should fine them.

[DaveB]

I'm getting seriously rusty on the technical aspects of Windows these days.

Does anyone know if the following are available to record as events?

- Use of "Run as Administrator"

- Provision of Administrator credentials when prompted by the OS