Solved

Can a Windows 2003 Server Event Log File be changed

Posted on 2010-08-24
4
493 Views
Last Modified: 2013-12-04
We are trying to find out what or who activated a service process on a server and a key log file entry is missing. I recreated the event on a test sever by starting the service and it generates an event log with my name on it. Can the .evt file be opened and changed then replaced.
0
Comment
Question by:brent4257
  • 3
4 Comments
 
LVL 3

Accepted Solution

by:
superggg earned 500 total points
ID: 33511842
Yes
To do this you must disable the event log service from running at boot
reboot, then edit the file (un-attribing it, then using notepad or Word.) Then re-enable the event log service and reboot again.
 
0
 
LVL 3

Expert Comment

by:superggg
ID: 33511855
The log files are located
Windows\System32\config
 
 
0
 
LVL 3

Expert Comment

by:superggg
ID: 33511965
Also a handy little utility
http://www.ntsecurity.nu/toolbox/winzapper/
 
 
0
 
LVL 1

Author Comment

by:brent4257
ID: 33512164
Ok I suspected it could be done now the question is how to prevent this from happening. Thanks
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
OfficeMate Freezes on login or does not load after login credentials are input.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now