The Curious Engineer

All blogs / Security

Windows Security Logging and Other Esoterica

learn.microsoft.com/en-us/archive/blogs/ericfitz

thoughts from the Windows auditing team

SecurityWindows internalsMicrosoft blogsMSDN archive

’05’10’15’20’25
Posts
75 from 9 Dec 2004 to 10 Jun 2012
Posting
archived, read-only
Kind
personal blog
Feed
https://learn.microsoft.com/en-us/archive/blogs/ericfitz/feed.xml

2012 1

  1. Farewell for now...

2011 3

  1. Off Topic: Unicode Right-to-Left Override character used by malware
  2. An interesting logging regulation that doesn't apply to Windows event logs...
  3. Decoding UAC Flags Values in events 4720, 4738, 4741, and 4742

2010 2

  1. Auditing Changes to Audit Policy
  2. XPath to generate a list of NTLM authentications on Windows Vista or Later

2009 2

  1. Auditing system impact on performance
  2. Mapping pre-Vista Security Event IDs to Security Event IDs in Vista+

2008 13

  1. Minimizing Directory Service Audit Event Noise
  2. Tracking User Logon Activity Using Logon Events
  3. ACS Event Retention Mechanism
  4. ACS' first bug from being too performant
  5. If you're gonna herd bots, do it from New Zealand!
  6. WEvtUtil Scripting
  7. Ned on Auditing
  8. Windows Server 2008 Security Events Posted
  9. Shameless Self-Promotion
  10. ACS Event Transformation Demystified
  11. You learn something new every day- Logon Type 0
  12. ACS Tidbits
  13. I always wondered who Björn was...

2007 18

  1. Why does Windows XP generate so many logon failure events?
  2. List of Windows Server 2003 Events
  3. German court bans retention of logged IP addresses
  4. Ensuring that there's no useful data in your logs...
  5. AT&T Team Up With Apple to Create Large-Scale Log Forwarding System Using Paper & US Postal Service
  6. EZ-Pass Logs Used in Divorce Cases
  7. Documentation on the Windows Vista and Windows Server 2008 Security Events
  8. United Kingdom passes EC telecom-logging legislation
  9. Good List of Regulatory Requirements for Logging
  10. Draft law in Germany may force telcos & ISPs to gather logs; Gmail Germany may shut down as a result
  11. *Not* generating logs is not an option... when you're under subpoena
  12. The Trouble With Logoff Events
  13. Enumerating Stuff in AD when all you see is GUIDs in Audit Records
  14. Auditing the Creation of Domain Controllers
  15. Vista security events get noticed
  16. We're #294!
  17. Where do I get my information on Windows auditing?
  18. Determining Whether a User Logged on Using A Smart Card

2006 11

  1. How are object access events generated?
  2. Trustworthiness of Information in Audit Records
  3. Auditing and the Payment Card Industry (PCI) Data Security Standard
  4. Logs and the US Department of Justice Cybercrime Manual
  5. Logs and the Canadian Rules for Electronic Evidence
  6. ISV Writing Reports for Operations Manager Audit Collector (formerly ACS)
  7. Sharepoint Portal Services Auditing Tool
  8. LogLogic posts open-source Windows log collection tool
  9. A good 3rd-party reference to the Windows security event log
  10. Quick Overview of Object Access Auditing in Windows
  11. Default ACLs on Windows Event Logs

2005 23

  1. Whetting your appetite for Windows Vista
  2. What the heck are "Primary User" and "Client User"?
  3. EU Passes New Log Retention Rule for Telcos
  4. Setting SACLs on Services
  5. Auditing Flaw in Microsoft SQL Server 2000
  6. Privilege Use- what do we audit, and when?
  7. How does Windows Audit meet Common Criteria compliance standards?
  8. What is up with Audit Collection Services?
  9. Managed Code Developers: You no longer have an excuse!
  10. Yay! A fix for EventQuery
  11. Preventing Log Evasion in IIS
  12. Multiple Events for Successful Account Creation
  13. Multiple Events for Failed Account Creation
  14. Logs and the Rules of Evidence
  15. Delegating Access to the Security Log
  16. COMMENT MY BLOG, PLEASE!
  17. Another culprit causes too many object access events.
  18. A Voice of Sanity from SANS
  19. Why don't I see the workstation name in logon events?
  20. Monitoring Active Directory Schema Changes
  21. Monitoring Group Policy Changes with Windows Auditing
  22. Deciphering Account Logon Events
  23. Keeping the noise down in your security log

2004 2

  1. Auditing Changes in Windows Server 2003 SP1
  2. Events 528 and 540