• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 508
  • Last Modified:

Can a Windows 2003 Server Event Log File be changed

We are trying to find out what or who activated a service process on a server and a key log file entry is missing. I recreated the event on a test sever by starting the service and it generates an event log with my name on it. Can the .evt file be opened and changed then replaced.
0
brent4257
Asked:
brent4257
  • 3
1 Solution
 
supergggCommented:
Yes
To do this you must disable the event log service from running at boot
reboot, then edit the file (un-attribing it, then using notepad or Word.) Then re-enable the event log service and reboot again.
 
0
 
supergggCommented:
The log files are located
Windows\System32\config
 
 
0
 
supergggCommented:
Also a handy little utility
http://www.ntsecurity.nu/toolbox/winzapper/
 
 
0
 
brent4257Author Commented:
Ok I suspected it could be done now the question is how to prevent this from happening. Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now